GitHub’s public APIs are becoming an enterprise reconnaissance tool

Attackers are systematically abusing GitHub's public APIs to map organizations, steal source code, and find secrets like API keys and cloud credentials, using a mix of fake dormant accounts and leaked credentials that blend into normal usage patterns. GitHub's public APIs don't require authentication for many operations and don't log geolocation data for external access, making it difficult to detect and stop this reconnaissance activity. The attacks involve automated scanner tools and coordinated networks of fake accounts that operate in short bursts across many organizations.