I made some changes to my GitHub account security, notably I added two new hardware security keys and removed SMS as a 2FA backup method.

8 days later today, I randomly checked the GitHub's own security log and found that next to these 3 events, there's also a 4th one from the same day - two_factor_authentication.recovery_codes_regenerated. That alarmed me a little. I went to view the codes to potentially re-generate and securely store them again, but the codes were the same as those I stored a few years ago.

On top of that, a new event appeared in the security log, now as expected - user.two_factor_recovery_codes_viewed. That surprised me because it now seems like interacting with the recovery codes falls under some sort of user type or namespace, instead of the two_factor_authentication type.

I tried to look up what the original event could be caused by, but to no success. I'm not too concerned right now - the fact the codes weren't touched (and the fact that regenerating them requires viewing them first) suggest this wasn't a result of someone compromising my account. Still, I'd rest easier knowing why did adding 2 hardware keys and removing an SMS number caused this weird 4th event to appear.

1 Answer 1


Several hours after posting this question, GitHub released a statement that these messages were caused by a bug during an upgrade to the 2FA platform.

The storage format of the per-user value GitHub uses to generate your recovery codes was updated, causing the watch job to trigger the erroneous recovery_code_regenerated event.

This also explains the discrepancy between one event using the user prefix and the other using the two_factor_authentication prefix - the accidental event was triggered by an automated watcher, not a user, and thus got assigned a different prefix/owner.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .