Delayed GitHub deprovisioning enabling post-termination repo access

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•6

Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.