docs/content/github/authenticating-to-github/keeping-your-account-and-data-secure/reviewing-your-security-log.md

title, intro, miniTocMaxHeadingLevel, redirect_from, versions, topics, shortTitle

title	intro	miniTocMaxHeadingLevel	redirect_from	versions	topics	shortTitle
Reviewing your security log	You can review the security log for your user account to better understand actions you've performed and actions others have performed that involve you.	3	/articles/reviewing-your-security-log /github/authenticating-to-github/reviewing-your-security-log	fpt ghes ghae * * *	Identity Access management	Security log

Accessing your security log

The security log lists all actions performed within the last 90 days.

{% data reusables.user_settings.access_settings %} {% ifversion fpt or ghae or ghes %} 2. In the user settings sidebar, click Security log. {% else %} {% data reusables.user_settings.security %} 3. Under "Security history," your log is displayed. 4. Click on an entry to see more information about the event. {% endif %}

{% ifversion fpt or ghae or ghes %}

Searching your security log

{% data reusables.audit_log.audit-log-search %}

Search based on the action performed

{% else %}

Understanding events in your security log

{% endif %}

The events listed in your security log are triggered by your actions. Actions are grouped into the following categories:

| Category name | Description |------------------|-------------------{% ifversion fpt %} | account_recovery_token | Contains all activities related to adding a recovery token. | billing | Contains all activities related to your billing information. | codespaces | Contains all activities related to {% data variables.product.prodname_codespaces %}. For more information, see "About {% data variables.product.prodname_codespaces %}." | marketplace_agreement_signature | Contains all activities related to signing the {% data variables.product.prodname_marketplace %} Developer Agreement. | marketplace_listing | Contains all activities related to listing apps in {% data variables.product.prodname_marketplace %}.{% endif %} | oauth_access | Contains all activities related to {% data variables.product.prodname_oauth_app %}s you've connected with.{% ifversion fpt %} | payment_method | Contains all activities related to paying for your {% data variables.product.prodname_dotcom %} subscription.{% endif %} | profile_picture | Contains all activities related to your profile picture. | project | Contains all activities related to project boards. | public_key | Contains all activities related to your public SSH keys. | repo | Contains all activities related to the repositories you own.{% ifversion fpt %} | sponsors | Contains all events related to {% data variables.product.prodname_sponsors %} and sponsor buttons (see "About {% data variables.product.prodname_sponsors %}" and "Displaying a sponsor button in your repository"){% endif %}{% ifversion ghes or ghae %} | team | Contains all activities related to teams you are a part of.{% endif %}{% ifversion not ghae %} | two_factor_authentication | Contains all activities related to two-factor authentication.{% endif %} | user | Contains all activities related to your account.

{% ifversion fpt %}

Exporting your security log

{% data reusables.audit_log.export-log %} {% data reusables.audit_log.exported-log-keys-and-values %}

{% endif %}

Security log actions

An overview of some of the most common actions that are recorded as events in the security log.

{% ifversion fpt %}

account_recovery_token category actions

Action	Description
confirm	Triggered when you successfully store a new token with a recovery provider.
recover	Triggered when you successfully redeem an account recovery token.
recover_error	Triggered when a token is used but {% data variables.product.prodname_dotcom %} is not able to validate it.

billing category actions

Action	Description
change_billing_type	Triggered when you change how you pay for {% data variables.product.prodname_dotcom %}.
change_email	Triggered when you change your email address.

codespaces category actions

Action	Description
create	Triggered when you create a codespace.
resume	Triggered when you resume a suspended codespace.
delete	Triggered when you delete a codespace.
manage_access_and_security	Triggered when you update the repositories a codespace has access to.
trusted_repositories_access_update	Triggered when you change your user account's access and security setting for {% data variables.product.prodname_codespaces %}.

marketplace_agreement_signature category actions

Action	Description
create	Triggered when you sign the {% data variables.product.prodname_marketplace %} Developer Agreement.

marketplace_listing category actions

Action	Description
approve	Triggered when your listing is approved for inclusion in {% data variables.product.prodname_marketplace %}.
create	Triggered when you create a listing for your app in {% data variables.product.prodname_marketplace %}.
delist	Triggered when your listing is removed from {% data variables.product.prodname_marketplace %}.
redraft	Triggered when your listing is sent back to draft state.
reject	Triggered when your listing is not accepted for inclusion in {% data variables.product.prodname_marketplace %}.

{% endif %}

oauth_access category actions

Action	Description
create	Triggered when you grant access to an {% data variables.product.prodname_oauth_app %}.
destroy	Triggered when you revoke an {% data variables.product.prodname_oauth_app %}'s access to your account.

{% ifversion fpt %}

payment_method category actions

Action	Description
clear	Triggered when a payment method on file is removed.
create	Triggered when a new payment method is added, such as a new credit card or PayPal account.
update	Triggered when an existing payment method is updated.

{% endif %}

profile_picture category actions

Action	Description
update	Triggered when you set or update your profile picture.

project category actions

Action	Description
access	Triggered when a project board's visibility is changed.
create	Triggered when a project board is created.
rename	Triggered when a project board is renamed.
update	Triggered when a project board is updated.
delete	Triggered when a project board is deleted.
link	Triggered when a repository is linked to a project board.
unlink	Triggered when a repository is unlinked from a project board.
update_user_permission	Triggered when an outside collaborator is added to or removed from a project board or has their permission level changed.

public_key category actions

Action	Description
create	Triggered when you add a new public SSH key to your {% data variables.product.product_name %} account.
delete	Triggered when you remove a public SSH key to your {% data variables.product.product_name %} account.

repo category actions

Action	Description
access	Triggered when you a repository you own is switched from "private" to "public" (or vice versa).
add_member	Triggered when a {% data variables.product.product_name %} user is {% ifversion fpt %}invited to have collaboration access{% else %}given collaboration access{% endif %} to a repository.
add_topic	Triggered when a repository owner adds a topic to a repository.
archived	Triggered when a repository owner archives a repository.{% ifversion ghes %}
config.disable_anonymous_git_access	Triggered when [anonymous Git read access is disabled](/enterprise/{{ currentVersion }}/user/articles/enabling-anonymous-git-read-access-for-a-repository) in a public repository.
config.enable_anonymous_git_access	Triggered when [anonymous Git read access is enabled](/enterprise/{{ currentVersion }}/user/articles/enabling-anonymous-git-read-access-for-a-repository) in a public repository.
config.lock_anonymous_git_access	Triggered when a repository's [anonymous Git read access setting is locked](/enterprise/{{ currentVersion }}/admin/guides/user-management/preventing-users-from-changing-anonymous-git-read-access).
config.unlock_anonymous_git_access	Triggered when a repository's [anonymous Git read access setting is unlocked](/enterprise/{{ currentVersion }}/admin/guides/user-management/preventing-users-from-changing-anonymous-git-read-access).{% endif %}
create	Triggered when a new repository is created.
destroy	Triggered when a repository is deleted.{% ifversion fpt %}
disable	Triggered when a repository is disabled (e.g., for insufficient funds).{% endif %}{% ifversion fpt %}
enable	Triggered when a repository is re-enabled.{% endif %}
remove_member	Triggered when a {% data variables.product.product_name %} user is removed from a repository as a collaborator.
remove_topic	Triggered when a repository owner removes a topic from a repository.
rename	Triggered when a repository is renamed.
transfer	Triggered when a repository is transferred.
transfer_start	Triggered when a repository transfer is about to occur.
unarchived	Triggered when a repository owner unarchives a repository.

{% ifversion fpt %}

sponsors category actions

Action	Description
custom_amount_settings_change	Triggered when you enable or disable custom amounts, or when you change the suggested custom amount (see "Managing your sponsorship tiers")
repo_funding_links_file_action	Triggered when you change the FUNDING file in your repository (see "Displaying a sponsor button in your repository")
sponsor_sponsorship_cancel	Triggered when you cancel a sponsorship (see "Downgrading a sponsorship")
sponsor_sponsorship_create	Triggered when you sponsor an account (see "Sponsoring an open source contributor")
sponsor_sponsorship_payment_complete	Triggered after you sponsor an account and your payment has been processed (see "Sponsoring an open source contributor")
sponsor_sponsorship_preference_change	Triggered when you change whether you receive email updates from a sponsored developer (see "Managing your sponsorship")
sponsor_sponsorship_tier_change	Triggered when you upgrade or downgrade your sponsorship (see "Upgrading a sponsorship" and "Downgrading a sponsorship")
sponsored_developer_approve	Triggered when your {% data variables.product.prodname_sponsors %} account is approved (see "Setting up {% data variables.product.prodname_sponsors %} for your user account")
sponsored_developer_create	Triggered when your {% data variables.product.prodname_sponsors %} account is created (see "Setting up {% data variables.product.prodname_sponsors %} for your user account")
sponsored_developer_disable	Triggered when your {% data variables.product.prodname_sponsors %} account is disabled
sponsored_developer_redraft	Triggered when your {% data variables.product.prodname_sponsors %} account is returned to draft state from approved state
sponsored_developer_profile_update	Triggered when you edit your sponsored developer profile (see "Editing your profile details for {% data variables.product.prodname_sponsors %}")
sponsored_developer_request_approval	Triggered when you submit your application for {% data variables.product.prodname_sponsors %} for approval (see "Setting up {% data variables.product.prodname_sponsors %} for your user account")
sponsored_developer_tier_description_update	Triggered when you change the description for a sponsorship tier (see "Managing your sponsorship tiers")
sponsored_developer_update_newsletter_send	Triggered when you send an email update to your sponsors (see "Contacting your sponsors")
waitlist_invite_sponsored_developer	Triggered when you are invited to join {% data variables.product.prodname_sponsors %} from the waitlist (see "Setting up {% data variables.product.prodname_sponsors %} for your user account")
waitlist_join	Triggered when you join the waitlist to become a sponsored developer (see "Setting up {% data variables.product.prodname_sponsors %} for your user account")
{% endif %}

{% ifversion fpt %}

successor_invitation category actions

Action	Description
accept	Triggered when you accept a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
cancel	Triggered when you cancel a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
create	Triggered when you create a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
decline	Triggered when you decline a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
revoke	Triggered when you revoke a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
{% endif %}

{% ifversion ghes or ghae %}

team category actions

Action	Description
add_member	Triggered when a member of an organization you belong to adds you to a team.
add_repository	Triggered when a team you are a member of is given control of a repository.
create	Triggered when a new team in an organization you belong to is created.
destroy	Triggered when a team you are a member of is deleted from the organization.
remove_member	Triggered when a member of an organization is removed from a team you are a member of.
remove_repository	Triggered when a repository is no longer under a team's control.

{% endif %}

{% ifversion not ghae %}

two_factor_authentication category actions

Action	Description
enabled	Triggered when two-factor authentication is enabled.
disabled	Triggered when two-factor authentication is disabled.
{% endif %}

user category actions

Action	Description
add_email	Triggered when you {% ifversion not ghae %}add a new email address{% else %}add a new email address{% endif %}.{% ifversion fpt %}
codespaces_trusted_repo_access_granted	Triggered when you [allow the codespaces you create for a repository to access other repositories owned by your user account](/github/developing-online-with-codespaces/managing-access-and-security-for-codespaces.
codespaces_trusted_repo_access_revoked	Triggered when you [disallow the codespaces you create for a repository to access other repositories owned by your user account](/github/developing-online-with-codespaces/managing-access-and-security-for-codespaces. {% endif %}
create	Triggered when you create a new user account.{% ifversion not ghae %}
change_password	Triggered when you change your password.
forgot_password	Triggered when you ask for a password reset.{% endif %}
hide_private_contributions_count	Triggered when you hide private contributions on your profile.
login	Triggered when you log in to {% data variables.product.product_location %}.{% ifversion ghes > 2.22 or ghae %}
mandatory_message_viewed	Triggered when you view a mandatory message (see "Customizing user messages" for details)
failed_login	Triggered when you failed to log in successfully.
remove_email	Triggered when you remove an email address.
rename	Triggered when you rename your account.{% ifversion fpt %}
report_content	Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.{% endif %}
show_private_contributions_count	Triggered when you publicize private contributions on your profile.{% ifversion not ghae %}
two_factor_requested	Triggered when {% data variables.product.product_name %} asks you for your two-factor authentication code.{% endif %}

user_status category actions

Action	Description
update	Triggered when you set or change the status on your profile. For more information, see "Setting a status."
destroy	Triggered when you clear the status on your profile.