Meta lost code and staff data to one stolen GitHub login. Check what your repos hold.

01 What happened at Meta

Two lines in that table matter more than the headline. The first is the secrets. Meta’s spokesperson said: "We’ve since rotated secrets found in the repositories" [ TNW 2026 ] . So the repos held working credentials as well as code and staff data. The second is the motive. Meta and GitHub believe the group was not after Meta in particular. A crew holding a stolen login opened whatever it reached. That describes your organisation’s risk as well as Meta’s.

Meta’s response is the standard one, and it is a good list to copy. It rotated the exposed secrets, added controls to keep user data out of GitHub, worked with GitHub on further protections and is adding proactive scanning to catch personal data uploaded by mistake. Affected people get credit and dark web monitoring, and regulators have been notified [ SecurityWeek 2026 ] .

02 The 1% that should not have been there

Nobody decides to store employee records in GitHub. They arrive one shortcut at a time. A developer exports 200 rows from production to reproduce a bug and commits the CSV as a test fixture. Someone pastes a database dump into a migration script. A notebook saves its output, names included, next to the code that produced it. Each commit solves a problem that afternoon.

Git then makes the mistake permanent. Deleting the file in a later commit leaves it in the history. Every clone on every laptop, every fork and every CI cache keeps a copy. An attacker with read access runs one command over the full history and gets everything that was ever committed, including what the team thinks it removed in 2023.

Teams treat internal repositories as safe. The numbers say that is where the problem lives. GitGuardian’s State of Secrets Sprawl 2026 found internal repositories roughly 6 times more likely than public ones to contain a hardcoded secret. It counted 28.65 million new secrets in public GitHub commits in 2025 alone, up 34% on the year. Of the credentials it confirmed as valid in 2022, more than 64% still worked when retested in January 2026 [ GitGuardian 2026 ] . A secret committed three years ago is usually still a live key.

03 One login, how many repositories?

Ask your engineering lead a simple question. If one developer’s GitHub session were stolen tonight, how many repositories could the thief clone before breakfast? Few teams can answer. GitHub organisations grow by default settings, and the defaults are generous.

• Base permissions. Many organisations give every member read access to every repository so onboarding is painless. One login then means the whole codebase.
• Long-lived tokens. Classic personal access tokens with the repo scope reach every repository the owner can see, often with no expiry. They live in shell history, IDE settings and old CI jobs.
• Leavers and contractors. Accounts that outlived the contract, and outside collaborators added to one repo three years ago and never removed.
• Machine identities. Deploy keys, GitHub Apps and bot accounts with broad scope, owned by nobody who still works there.

Then the second hop. Repositories hold cloud keys, database passwords and API tokens. Meta had to rotate the ones it found. In most companies those secrets reach systems far more sensitive than the code. GhostAction showed the CI side of this problem, where a malicious workflow ships pipeline secrets out; we covered that in our GhostAction analysis. The Meta case is the simpler version. No malicious code at all, just a valid login reading what it was allowed to read.

04 Six checks for your GitHub organisation

An engineering lead with organisation owner rights can finish these in a week. Start with the first two. They tell you how big the problem is.

Meta found its intrusion, cut it off and told people. The data was still gone, because the login was valid and the repos held what they held. Your exposure comes down to two numbers: how many repositories one account can read, and what sits in their history. We measure both in 14 days. You get every secret and every piece of personal data we can reach from a single developer identity, what each one opens, and the change that closes each path. Start with your Threat Map, from $5,000. Enterprise-grade. Not enterprise-priced.