About 1.25 months ago, my account unfortunately had a legacy API key that was compromised. That API had access to post GitHub issues on any public repos. As a result, the bad actor posted a total of 5 spam issues on various repos on GitHub. I discovered this and performed the following actions.
* I went and deleted those unauthorized issues from those repos, * I deleted the API key that was the culprit (I couldn't find an audit log to verify though) * I created a more specific API key for my app using the new "fine grain access" method * I removed every oauth service access and reconnected the only ones still in use * I reset my password and signed out of all active sessions. (I already have MFA and passkey enabled)
Shortly after performing those actions, they "flagged my account as spam" (effectively shadowbanned) my account, and now all my projects are inaccessible publically.
I immediately submitted an "Appeal for account reactivation", however as of posting this, it has been over a month with no response. No confirmation, no "we are working on it", nothing.
So I took some time to pop over to GitHub discussions to search, and it appears that GitHub simply does not respond to these appeals, because if you search "no response" you will see pages and pages of the same story. Opened, 3-4 months or more, still no response.
So I guess the moral of this post, is that in 2024 if you are seeking a good platform for hosting your code in the cloud, don't expect any support whatsoever from Github.
It is absolutely unacceptable for a company who has paid subscriptions (which I pay for monthly and also pay for copilot) to simply not respond to their customers. If they cant get back to customers who have multiple years of verifiable account behavior, they should explain that in their terms of service.
They completely derailed my project deployments and access to my open-source software for public users/devs. Shadowbans also breaks all oAuth login links so any external sites you logged into "using your GitHub account" are also broken. Meaning you will lose access to ANY external sites who use that method.
Thanks for reading my rant.
