Product
GitHub SSO recovery codes act as break-glass credentials bypassing IdP-enforced MFA, and their unauthorized generation, access, or usage indicates potential credential access or persistence attempts.