GitHub offboarding is the process of removing a departed user’s access from GitHub and related development tools. It includes disabling the account, revoking personal access tokens, deleting or rotating SSH keys, removing app and OAuth permissions, and clearing any active sessions or organization memberships. The goal is to make sure a person who no longer works for the organization cannot still reach private code or automation.
This matters because leftover access is a common security gap. If an old token, key, or app grant stays valid, an attacker who steals it can clone repositories, read source code, or abuse CI/CD permissions. Good offboarding reduces the blast radius of compromised laptops, leaked credentials, and insider risk. Defenders should treat it as a routine control: deprovision immediately, rotate secrets tied to the user, review repository and audit logs, and confirm that machine accounts or bots are not still trusting the departed user’s identity.