And another one. GitHub ships break-glass credential revocation

GitHub added enterprise-wide bulk credential revocation to enable a one-action cutoff of compromised credentials after a series of supply-chain and credential-harvesting incidents (notably Trivy→Checkmarx and Microsoft durabletask). The report attributes repeated re-infections to incomplete credential rotation and infostealer activity, explains why atomic rotation is impractical at org scale, and recommends assigning the "Manage enterprise credentials" permission to responders, pinning Actions to commit SHAs, and monitoring pipelines for poisoned packages.