Reinstatement Request --- Time Length

[temporary-account-13623]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Profile

Body

My github account had a leaked token last week which uploaded malicious code to several repositories I don't own before breaking the community standards quite flagrantly in order to trigger an account suspension (someone analyzed the .exe it uploaded and concluded that this is an intentional strategy to prevent the malicious upload from being removed). I deleted the token, which seemed to have ended the attack but while I was starting to clean up my account was suspended. I have submitted a reinstatement request but have yet to hear any response. As a result, there are several repositories with malicious code released on them which I can't do much about. I made this account to try to get them to at least address this security issue, since there is no option to submit a ticket about repositories if you can't sign in

I see some posts here about github support taking months to respond to reinstatement requests. Is that really true? It seems like an astonishingly long wait time and frankly is making the security issue dramatically worse in my case. It seems that github's poor reinstatement resolution timescale is being exploited by bad actors as a security flaw in itself.

Is there anything I can do both to accelerate the timeline for the reinstatement request or to get the malicious releases removed while I am waiting? Thanks!

Edit: Ticket is #4829161

[Zinatullah-Akrami]

I’m experiencing the same issue. I was trying to use GitHub Copilot when I received a message saying that my account had been suspended. I wasn’t sure what had happened or what I might have done wrong, so I tried logging in to my GitHub account and discovered that it had indeed been suspended.

I’m not sure what caused the suspension, as I haven’t received a clear explanation. I would appreciate any clarification regarding the reason for this action.

[temporary-account-13623]

Hi, I'm hoping to bump this discussion.

Its now been 3 weeks and I have yet to hear back any response. In there anyone at github who I can contact for at least an initial response to the ticket letting me know how long it will be?

I still don't know exactly which public repositories are affected and I think most of the really high priority ones I've gotten others to deal with, but the long time to get an account reinstated is a significant security issue in this case.

[cachewraith]

---

Sorry you're dealing with this. The community can't see or speed up tickets, but you can still act while you wait:

1. Report the malware from any other account at github.com/contact/report-abuse (choose malware). Include the repo URLs, release links, and the .exe SHA-256. It's like reporting a stolen car: you can call the police even if your own license is suspended.
2. Tell the repo owners. They can delete the releases and commits themselves in minutes.
3. Reply to your existing ticket instead of opening new ones. Give a short timeline (token leaked, revoked, uploads weren't you) and mention the active malware on public repos.

Honest take: 3 weeks is long, and there's no official fast lane for free accounts. The abuse reports are what GitHub treats as urgent.

Once you're back in: revoke all tokens/keys/apps in settings, rotate any secrets, turn on 2FA, and use fine-grained tokens with short expiry.

---

[temporary-account-13623]

I did open a ticket for that 3 weeks ago when I created this account.. The discussion forum and creating that ticket is all I am doing with this account

Github support seems to have ignored that ticket.

[temporary-account-13623]

I see from this discussion https://github.com/orgs/community/discussions/211407 that a ticket opened october 9th has been closed. I submitted this ticket October 6th and have yet to receive an initial response. Could anyone at github confirm that this ticket is in the queue properly? It looks like @v-ember might have some insight into this process?

Ticket number is #4829161

[temporary-account-13623]

Maybe @queenofcorgis has enough insight to confirm that this ticket is in the right place and in the queue). I see that the github procedural process has been found to be buggy before (https://github.com/orgs/community/discussions/170974) and this doesn't not seem to have been answered in order of submission which makes me very worried that something is wrong with the process. Not sure where the correct place to ask this is other than in the ticket, which I suspect may not be reaching github support at all. Should I be considering opening another ticket if this first ticket doesn't get to replied to at some point?

[temporary-account-13623]

@github-staff @canuckjacq can anyone help me determine the status and length of time I should expect to wait on this ticket? I'm happy to provide whatever information you need, but its been over three weeks with not even an initial response.

[temporary-account-13623]

@marzann maybe you are the right person to ping with this issue? I don't really know who to contact since there are no responses through the ticket channel and there seems to be no backup (other than the one person who was able to involve the EU's GDPR regulatory process).

[buhaykulay58-sys]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Profile

Body

My github account had a leaked token last week which uploaded malicious code to several repositories I don't own before breaking the community standards quite flagrantly in order to trigger an account suspension (someone analyzed the .exe it uploaded and concluded that this is an intentional strategy to prevent the malicious upload from being removed). I deleted the token, which seemed to have ended the attack but while I was starting to clean up my account was suspended. I have submitted a reinstatement request but have yet to hear any response. As a result, there are several repositories with malicious code released on them which I can't do much about. I made this account to try to get them to at least address this security issue, since there is no option to submit a ticket about repositories if you can't sign in

I see some posts here about github support taking months to respond to reinstatement requests. Is that really true? It seems like an astonishingly long wait time and frankly is making the security issue dramatically worse in my case. It seems that github's poor reinstatement resolution timescale is being exploited by bad actors as a security flaw in itself.

Is there anything I can do both to accelerate the timeline for the reinstatement request or to get the malicious releases removed while I am waiting? Thanks!

Edit: Ticket is #4829161

remove them