Found Out Why just received this email from github, Crazy.
A security vulnerability has recently been discovered that allowed an attacker to add new SSH keys to arbitrary GitHub user accounts. This would provide an attacker with a clone / push access to the repositories with read permissions, and a clone / pull / push access to the repositories with write permissions. As of 5:53 p.m. UTC on Sunday, March 4, the vulnerability no longer exists.
Until any known malicious activity has been reported, we take extra precautions by forcing an audit of all existing SSH keys.
Mandatory action
Since you have one or more SSH keys associated with your GitHub account you should visit https://github.com/settings/ssh/audit to approve every valid SSH key.
Unless you have approved SSH keys, you cannot clone / pull / push your SSH repositories.
condition
We take security seriously and acknowledge that this should never have happened. In addition to a full code audit, we have taken the following measures to increase the security of your account:
- We force auditing of all existing SSH keys
- Adding a new SSH key now asks for your password
- Now we will send you an email when a new SSH key is added to your account.
- Now you have access to the account change log on the account settings page Regards, GitHub team.
--- https://github.com support@github.com
source share