I made some changes to my GitHub account security, notably I added two new hardware security keys and removed SMS as a 2FA backup method.
8 days later today, I randomly checked the GitHub's own security log and found that next to these 3 events, there's also a 4th one from the same day - two_factor_authentication.recovery_codes_regenerated. That alarmed me a little. I went to view the codes to potentially re-generate and securely store them again, but the codes were the same as those I stored a few years ago.
On top of that, a new event appeared in the security log, now as expected - user.two_factor_recovery_codes_viewed. That surprised me because it now seems like interacting with the recovery codes falls under some sort of user type or namespace, instead of the two_factor_authentication type.
I tried to look up what the original event could be caused by, but to no success. I'm not too concerned right now - the fact the codes weren't touched (and the fact that regenerating them requires viewing them first) suggest this wasn't a result of someone compromising my account. Still, I'd rest easier knowing why did adding 2 hardware keys and removing an SMS number caused this weird 4th event to appear.
