What should you do when a developer leaves: a GitHub offboarding list

Remove the person from the organization, or from the identity provider group if membership is managed there, then rotate any secrets their role could read, revoke their tokens and review apps they authorized. GitHub keeps membership data for three months, so a reinvite in that window restores their forks.

What removal does and does not do

GitHub documents these effects of removing a member:

• They lose access to private forks of the organization's private repositories, but may keep local copies.
• Forks in other organizations are controlled by those organizations.
• Pending invitations they sent are canceled.
• Membership data is kept for three months, and a reinvite in that period can restore their data and private forks.
• Volume license billing does not downgrade automatically.

The page also says you are responsible for making sure they delete confidential material. A local clone cannot be recalled.

The checklist

1. If membership comes from SCIM or an identity provider, remove the user there first. With managed users linked to IdP groups, remove them from those groups.
2. Otherwise, open the organization People tab, select the member and remove them.
3. Review repository roles that were granted directly rather than through teams.
4. Rotate Actions secrets and variables for repositories where they held Write or above.
5. Revoke their fine-grained tokens from the organization token list, and check deploy keys they added.
6. Review OAuth apps and GitHub Apps they installed or approved.
7. Search the audit log for their recent activity and note anything odd.
8. Transfer ownership of their repositories, scheduled workflows and bot accounts.
9. Downgrade licenses if you pay by volume.

Order matters

Remove access before you have the sensitive conversation when the exit is contentious. Do the secret rotation the same day, not next sprint. For a planned, friendly departure you can stage it: knowledge transfer first, then removal on the last day, then rotation.

Keep the evidence

Auditors look for timely removal. Keep a ticket with the date of the notice, the date of removal and the list above ticked off. If you also run a contractor process, use the same list. A single path is easier to follow and easier to prove. Review the list once a year against a real departure, and fix any step that was slow or skipped.

Where Safeguard fits

Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.

Quick check

Sources

• Removing a member from your organization (GitHub Docs)
• Reviewing and revoking personal access tokens in your organization (GitHub Docs)

Last reviewed: 19 October 2026.