How should a package maintainer secure their GitHub account?

Treat your GitHub account as the key to your releases. Turn on 2FA, add a security key or passkey, keep a second method as a fallback, and store recovery codes outside your phone. GitHub says its support cannot restore a 2FA account if you lose both credentials and recovery methods.

Why the account matters for npm and PyPI

If your publish workflow runs on GitHub and uses trusted publishing, then whoever controls the repository and its workflow files controls what gets uploaded. Both npm and PyPI trusted publishing tie uploads to a repository and workflow. So the account behind the repository is, in practice, a publishing credential.

What GitHub offers

From GitHub's documentation:

• Authenticator app or SMS are the base second factors.
• Security keys (hardware keys, Touch ID, Windows Hello) can be added once a base method exists, using WebAuthn.
• Passkeys are optional. They merge the password and 2FA steps into one sign-in. GitHub advises keeping a fallback 2FA method to avoid lockouts.
• GitHub Mobile can be a second factor after you set up an app or SMS. It uses public key cryptography.

GitHub says it strongly urges 2FA on every site that supports it. It also notes that since March 2023 contributors who write code on GitHub.com were required to enable 2FA in staged groups, while still recommending it to everyone.

For the phishing angle, see how passkeys resist phishing.

Setup order

1. Enable an authenticator app as the base method.
2. Add a security key. Our post on Apple security keys explains why two is the right number.
3. Download recovery codes and store them in a password manager or printed in a safe place.
4. Add a secondary recovery option where offered.
5. Review your signed in devices and authorized apps, and remove old ones.
6. Do the same for the registry accounts, as covered in npm 2FA modes and recovery.

The lockout risk is real

A solo maintainer has nobody to call. If the phone dies and the codes were only on that phone, the account may be gone, and with it the repository and the release pipeline. Test your recovery path once a year. Our lost phone playbook for engineers walks through it.

Things 2FA does not fix

• A token you committed or pasted somewhere. See the first hour after leaking an API key.
• A malicious dependency that runs on your laptop and steals session cookies.
• An expired email domain used for recovery. See expired email domains and account recovery risk.

For a quick look at what your own project pulls in, the free scan at gold.safeguard.sh/scan lists dependencies and known issues.

Quick check

Sources

• GitHub docs: About two-factor authentication

Last reviewed: 19 October 2026.