A repo compromise found in week four outlives GitHub's seven-day Git event log

Do the subtraction on a realistic discovery lag. If a repository compromise surfaces 30 days after initial access, 23 of those days of Git read and write activity sit outside GitHub's default window ^[15]. What remains is the standard audit log, and Wiz's own framing is that standard audit logs do not capture all activity and that default retention limits severely restrict historical investigations ^[10]. The clone and fetch record, meaning the evidence of what an attacker actually pulled out of the repositories, is the part that expires first ^[3].

GitLab presents a different shape of the same problem. In a standard configuration, Git operations are never written to the database, so those events are unavailable no matter when the investigation opens, unless log streaming was configured in advance ^[4].

The API layer is thinner still. Wiz reports 88 percent of its customers on SaaS version control, where the raw API requests to the server are abstracted away from the tenant ^[5]. One of the four platforms in the poster lets an organisation log those requests, and only with explicit configuration plus streaming ^[6], which leaves three with no organisation-visible API log at all ^[16]. Wiz places early-stage discovery and enumeration in exactly that telemetry, ahead of any impact ^[7]. Whether you can see the reconnaissance phase is therefore settled by which vendor you signed with.

Two configuration items carry most of the weight in the readiness checklist. Streaming is the first, and Wiz notes it is frequently restricted to higher license tiers, which turns a telemetry decision into a procurement one ^[8]. Source IP capture is the second: GitHub does not expose actor IP addresses in audit logs unless the setting is enabled manually, and without it, tracing the origin of malicious activity gets significantly harder ^[9].

This is a single-source account, and worth reading as one. Wiz is describing platform defaults it also sells around, and its suggestion that these logs go to a cloud detection and response platform rather than a legacy SIEM is a product argument ^[13]. The retention and licensing claims themselves are checkable against each vendor's documentation, which is where anyone acting on this should confirm their own tier. The checklist behind them comes from Wiz CIRT casework across multiple supply chain attacks and targeted campaigns ^[12], and Wiz cites campaigns attributed to TeamPCP as an example of actors going after version control systems directly ^[11].

No patch cycle applies here. The remediation is a configuration change and a destination for the events, and its value is decided entirely by whether it was made before the intrusion rather than after ^[14].