Get help with GitHub Enterprise Server

Please see our blog post Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators for a summary of the results of our investigation to date and our recommended next steps for customers.

If you have questions or need assistance regarding affected OAuth applications maintained by Heroku, please reach out to Salesforce / Heroku security and support at help.heroku.com, and monitor the Salesforce Trust site for additional updates. If you have questions or need assistance regarding affected OAuth applications maintained by Travis CI, please reach out to compliance@travis-ci.com. Customers who are directly contacted by GitHub regarding this issue are welcome to contact us according to directions in the notification you received.

• You can Cancel your GitHub Copilot subscription at any time.
• If you cancel during your 60 day trial, you won't be charged.
• If you do not cancel your GitHub Copilot subscription before the end of the 60 day trial, you will be charged according to the billing cycle you selected when setting up the trial.

For more information, refer to the About billing for GitHub Copilot documentation.

If you require further assistance, please contact our billing team. We will try to process your requests as soon as possible but there may be a delay of several days. We really appreciate your patience during this busy period.

Please see our blog post End of the Beta - Codespaces for Individuals for a summary of the changes to Codespaces Beta program for individuals.

To keep using Atom, please download a previous Atom version. You can read more on our blog.

To keep using GitHub Desktop, please download a previous GitHub Desktop version. You can read more on our blog.

When setting up the FreeOTP authenticator app, you may see an error indicating that the "Token is unsafe!". This is because GitHub uses an 80 bit key for TOTP secrets as a compatibility shim for Google Authenticator, which also used 80 bit keys. FreeOTP validates that the key is at least 128 bits in length, and shows an "unsafe algorithms" error as a result. Because we can't control who uses which authenticator app, we opt for supporting Google's app over potentially blocking their ability to use TOTP.

When choosing an authenticator app, please prefer apps that support cloud backup of your secrets such as Authy, 1Password, or Microsoft Authenticator. A top cause of account lockout is phone loss, where the TOTP secrets for an account are held only on the previous phone.

Check out this Changelog post for more information about the changes and why they are needed.

Only customers using a high volume of API requests will be affected. If you would like to learn about how rate limits work and how to check your current status, you can find out more in our documentation.