GitHub has added support for securing SSH Git operations using FIDO2 security keys for added protection from account takeover attempts.

GitHub rotated keys potentially exposed by a vulnerability patched in December that could let attackers access credentials within production containers via environment variables.

To confirm that your public key has been configured correctly, check the SSH and GPG link in your account settings. If no keys are listed, add your public key and try to connect to GitHub over SSH ...

Thousands of new API or cryptographic keys leak via GitHub projects every day.

Here's a quick example of how to perform a GitHub SSH clone operation. In just five minutes, learn how to create SSH keys, configure them in GitHub and perform the GitHub clone with SSH keys in Git.

Hanley, who is also GitHub's SVP of Engineering, said that they quickly contained the exposure and investigated the root cause of the issue. GitHub's RSA SSH Private Key Accidentally Leaked to Public!