Unexpected security log events after authorizing CodeRabbit

[FELZ-master]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Issues

Body

Hi everyone,

I’m trying to understand whether anyone else has experienced something similar after authorizing the CodeRabbit integration on GitHub.

Shortly after connecting CodeRabbit to my GitHub account, I noticed several unexpected events in my GitHub security log, including:

• oauth_authorization.create
• oauth_access.create
• oauth_access.regenerate
• payment_method.remove
• org.remove_member
• personal_access_token.access_revoked

What concerns me most is that these events appeared right after the integration was connected, including removal from the organization, payment method removal, and revocation of personal access token access.

At the moment, we also no longer have an active organization owner on our side because the owner account/member was removed, so we are currently unable to manage organization settings or fully investigate this from within the organization.

At this point, I am not claiming with certainty that CodeRabbit directly caused all of these changes, but the timing is concerning and I want to understand whether:

1. anyone else has seen similar security log events after authorizing CodeRabbit or another third-party GitHub app
2. these events can be expected as part of a normal OAuth / GitHub App authorization flow
3. GitHub can confirm from the audit/security log whether these actions were actually tied to the OAuth application

If anyone has seen something similar, I would appreciate hearing what happened and how you verified the cause.

Thanks.

Guidelines

• I have read the above statement and can confirm my post is relevant to the GitHub feature areas Issues and/or Projects.

[HamiParsa]

Hi there,

This is a really concerning situation, and you're absolutely right to be alarmed. Let me break this down for you.

🚨 The short answer:

No, this is NOT normal. A GitHub App or OAuth integration like CodeRabbit should never trigger events like:

payment_method.remove

org.remove_member

personal_access_token.access_revoked

These are highly sensitive security events that should only happen through manual user action or a compromised account.

What's likely happening here:

There are two possibilities:

1. Your account was already compromised (unrelated to CodeRabbit)

It's possible that an attacker had access to your account before you installed CodeRabbit, and the timing is purely coincidental. The attacker may have:

Removed the org owner to lock you out

Removed payment methods to avoid detection

Revoked tokens to prevent recovery

2. CodeRabbit (or the OAuth flow) was a trigger, not the cause

Authorizing CodeRabbit generated new OAuth tokens. If your account was already compromised, the attacker might have used this moment to execute their malicious actions while you were distracted.

What to do RIGHT NOW (urgent):

Contact GitHub Support IMMEDIATELY

Go to: https://support.github.com/contact

Choose "Security" → "I suspect my account has been compromised"

Tell them:

Your organization owner was removed

Payment method was removed

Tokens were revoked

Provide the exact timestamps from your security log

Share the screenshot you have

This is a security emergency – GitHub Support prioritizes these tickets.

Do NOT try to re-add yourself as an owner yet

Wait for GitHub Support to help you recover the organization properly. Doing it wrong might lock you out permanently.

Check your personal account security

Go to Settings → Security → Sessions and revoke all active sessions

Enable 2FA if you haven't already

Check Settings → SSH and GPG keys for any unknown keys

Check Settings → Applications → Authorized OAuth Apps and revoke anything suspicious

Change your password immediately

Review the CodeRabbit permissions

Even if CodeRabbit is innocent, check what permissions you granted:

Go to Settings → Applications → Installed GitHub Apps

Click on CodeRabbit and review the permissions it requested

If it had admin:org or repo permissions, that's normal for a code review bot

But it should NOT have billing or member management permissions

To answer your specific questions:

"Has anyone else seen similar events after authorizing CodeRabbit?"

I haven't seen widespread reports of this. CodeRabbit is a legitimate and well-known tool. This strongly suggests your account was compromised before installing CodeRabbit, and the timing was coincidental.

"Can GitHub confirm if these actions were tied to the OAuth app?"

Yes! GitHub's audit logs show:

The user who performed each action

The IP address

The user agent (browser/device)

Whether it was done via the UI, API, or OAuth app

GitHub Support can tell you exactly what performed those actions – whether it was your account, an attacker, or CodeRabbit's OAuth token.

Summary of actions:

✅ Contact GitHub Support immediately – this is urgent

✅ Revoke all sessions and change your password

✅ Enable 2FA if not already done

✅ Check for unknown SSH keys and authorized apps

✅ Wait for GitHub Support to help restore org ownership

❌ Do NOT try to re-add yourself as owner manually

I know this is scary, but GitHub's security team is actually very responsive to compromised account reports. They can help you recover everything.

Keep us posted! Stay calm and act quickly. 🙏

[ymxlx]

These events fall into two groups.

oauth_authorization.create, oauth_access.create, and oauth_access.regenerate can be consistent with authorizing or refreshing access for an OAuth application. The other events aren't routine side effects of installing a code-review app. Still, their timing doesn't prove that CodeRabbit caused them.

I suggest opening each event and comparing these fields:

• actor and actor_id
• oauth_application_id or the application name
• programmatic_access_type
• user_agent and operation_type
• the affected user and organization

The event names can be misleading without those details. org.remove_member can result from a manual removal or a two-factor authentication requirement. personal_access_token.access_revoked means the token lost access to that organization; it doesn't necessarily mean the entire token was deleted. payment_method.remove means a payment method was removed.

I suggest preserving the event details and timestamps before changing anything else. Since the organization owner isn't accessible anymore, secure the personal account, revoke any suspicious sessions and app authorizations, review SSH keys and tokens, and open a GitHub security support ticket. Include the event timestamps and IDs, but don't post sensitive log details publicly.

Only GitHub Support can correlate these events with backend authentication and access records.

References:

• Security log events
• Organization audit-log events
• About GitHub Support

[initial-d]

I would treat this as an incident investigation, but I would be careful about attributing all of the events to CodeRabbit just from timing.

The events you listed are not all the same class:

Likely normal OAuth/app authorization path:
- oauth_authorization.create
- oauth_access.create
- oauth_access.regenerate

Not normal side effects of a code review app authorization:
- payment_method.remove
- org.remove_member
- personal_access_token.access_revoked

The second group needs investigation, but GitHub Support will need the event-level metadata to connect or separate them.

Before changing anything else, I would export/preserve the details for each event and compare:

• actor / actor_id
• affected user / org
• application name or OAuth application id
• user agent
• IP address / location if shown
• operation type
• exact timestamp with timezone
• event id if available

GitHub’s references for the event names are useful here:

• Personal security log events: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
• Organization audit log events: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization

A few important interpretations:

1. personal_access_token.access_revoked can mean a token lost access to an organization. It does not always mean the whole token was deleted.

2. org.remove_member should identify the actor who removed the member or the policy/action that caused removal. If the active org owner was removed, that is the most urgent item to escalate.

3. payment_method.remove should not be a normal side effect of installing a code review app. If the actor is not you, treat it as suspicious account activity.

4. OAuth app authorization can create/regenerate OAuth access events without implying the app caused unrelated billing/org membership events.

Immediate steps I would take:

1. Secure the personal account first: password reset, 2FA/passkeys, sign out other sessions.
2. Revoke unknown OAuth apps and GitHub Apps.
3. Review PATs, fine-grained tokens, SSH keys, deploy keys, and Codespaces/Actions secrets.
4. Preserve all security/audit log event details.
5. Open/continue a GitHub Security Support ticket and ask them to correlate the event ids/timestamps server-side.

Because you no longer have an active organization owner, I would explicitly frame the ticket as an organization recovery / suspicious audit-log correlation issue, not just a question about CodeRabbit. Only GitHub can confirm whether the same actor/session/app was responsible for the org.remove_member, payment_method.remove, and token access events.