After losing a laptop, revoke its GitHub web session, delete its SSH keys, delete or regenerate personal access tokens, and revoke authorized OAuth apps. Do it from another device, in that order, then review the security log. Each step closes a different door, so doing only one is not enough.
Why four steps, not one
A laptop that talks to GitHub can hold four different kinds of credential. A browser session cookie, an SSH private key, a personal access token stored by a credential helper, and OAuth app tokens issued to tools you signed in to. Revoking one leaves the others working.
Start from a trusted device and, if you can, sign out of other places first. For the wider response, see Lost or stolen developer laptop: first hour checklist. This post covers GitHub only.
Step 1: revoke the sessions
GitHub documents that you can view a list of devices that have logged in and revoke sessions you do not recognise. Go to Settings, then Sessions under Access. Under Web sessions, open See more for a session and choose Revoke session. Under GitHub Mobile sessions, revoke the entry for the lost device. GitHub notes that revoking a mobile session signs you out of the app on that device and removes it as a second factor option, so set up another second factor first.
Step 2: delete the SSH keys
GitHub's guidance says you can delete unauthorised or possibly compromised SSH keys so an attacker no longer has access to your repositories. Open Settings, then SSH and GPG keys. If you cannot tell which key was on the lost laptop, delete the ones that match its name or date added, then re-add keys from devices you still hold. Also check deploy keys on repositories you admin.
Remember: deleting the public key on GitHub stops it working there. The private key is still on the laptop, so it remains valid on any other server that trusts it. Remove it from those too.
Step 3: delete or replace the tokens
GitHub supports fine-grained personal access tokens and personal access tokens (classic), and it recommends fine-grained ones when possible. Both are tied to the user who generated them. In Settings, under Developer settings, find Personal access tokens, delete those used on the laptop, and create new ones with narrower scope and an expiry. Update CI secrets that used them.
Step 4: revoke OAuth apps
GitHub says you should review authorized applications and check that none have expansive permissions, such as access to private repositories. In Settings, open Applications, then Authorized OAuth Apps. You can revoke individual apps, or use Revoke all if you want to be thorough. You will sign in again to the tools you use.
Step 5: review and tell people
Check the security log for sign ins and token use after the loss time. If you are an organization owner, check audit logs for actions from the user. Then notify your security contact with the loss time, what repositories the person could reach, and which steps are done.
| Credential | Where to remove it | Cuts off |
|---|---|---|
| Web session | Settings, Sessions | Browser access |
| SSH key | Settings, SSH and GPG keys | Git over SSH |
| Personal access token | Developer settings | API and HTTPS Git |
| OAuth app | Settings, Applications | Third party tools |
Make the next loss cheaper
Use disk encryption, short token lifetimes and passkey or hardware key sign in. Safeguard does not handle device loss, but its dependency scanning, SBOMs and policy gates help you see what a compromised account could have changed. Try the free scan after an incident.
Quick check
Does changing my GitHub password revoke SSH keys?
No. SSH keys and tokens are separate credentials, so remove them individually.
Should I also rotate secrets stored in repositories?
Yes, if the laptop had clones or environment files with secrets in them. Rotate them even if you believe the disk is encrypted.
Sources
- Viewing and managing your sessions, GitHub Docs
- Reviewing your SSH keys, GitHub Docs
- Managing your personal access tokens, GitHub Docs
- Reviewing your authorized OAuth apps, GitHub Docs
Last reviewed: 19 October 2026.
