GitHub
How to remove a departing employee from GitHub
Updated · 7 min read
Most developers use a personal GitHub account that they keep after leaving. That makes GitHub offboarding different from most tools: you are not deleting their account, you are removing their access to your organization and everything that access could reach.
Because source code, deployment keys, and CI secrets live here, GitHub is usually one of the highest-risk systems in an offboarding.
Remove them from the organization
- 1
Remove the member
In your organization's People settings, remove the person. They lose access to the organization's private repositories, teams, and projects.
- 2
Check outside collaborator access
People added directly to individual repositories as outside collaborators are not organization members, so removing membership does not cover them. Remove them from each repository.
- 3
Review team maintainer and admin roles
If the person administered teams or repositories, reassign those roles first so nothing is left without an owner.
- 4
Transfer owned GitHub Apps and OAuth apps
Apps the person registered on behalf of the organization should be transferred so integrations do not break or stay under their control.
Tokens, keys, and SSO
Personal access tokens and SSH keys belong to the person's GitHub account, not your organization. Removing them from the organization stops those credentials reaching your private repositories, but it does not delete the credentials.
- If you use SAML single sign-on for the organization, review and revoke the credentials the person authorised for SSO.
- Deploy keys added to repositories are tied to the repository, not the person. Remove any the person created and no longer need.
- With Enterprise Managed Users, accounts are controlled by your identity provider, so suspending the user there is the primary step.
Rotate what they could see
Removing access stops future use, but anything the person could read is already known to them. For engineers with broad access, rotate:
- Repository and organization Actions secrets they could view or manage.
- Cloud credentials and API keys stored in repositories or CI configuration.
- Webhook secrets and deploy keys for services they set up.
- Shared credentials in password managers the team used for deployments.
Check the audit log
The organization audit log shows repository clones, visibility changes, and permission changes. Reviewing activity in the weeks before departure is good practice for high-access roles, and the log is also your evidence of when membership was removed.
How PurpletGo handles GitHub offboarding
PurpletGo connects to your GitHub organization through GitHub OAuth, on every plan. When an admin revokes access for a departing employee, PurpletGo removes them from the organization and records the result next to the other systems in the same case.
- Removes the person's organization membership, using the GitHub username stored on their employee record.
- Cancels any pending invitation to the organization for that username.
- Runs in the same action as identity provider and other app revocations, and the run is audit-logged with the admin who started it.
- Outside collaborators on individual repositories, tokens, and secrets are not changed, so keep those steps as checklist tasks in the same offboarding.
30-day free trial - no credit card required