GitHub OAuth Token Used by Terminated Employee to Access Org

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•6

This rule detects unauthorized GitHub repository access or OAuth activity performed by a user account identified as terminated in the organization's HR system. It uses a watchlist to cross-reference GitHub audit logs against terminated employee records, applying a 2-hour grace period to account for potential log synchronization delays or final offboarding tasks.