GitHub will require 2FA for all developers who commit by September 2, 2026.

End of a transition started in 2022 - the real passive remains the automation workflows still relying on non-2FA tokens.

The fact

GitHub is making two-factor authentication (2FA) mandatory for any developer who contributes (commits, PR, review) to the platform by September 2, 2026 (Hacker News, 07/20/2026, top of home). The switch finalizes the program launched in 2022 after several popular repositories were compromised by token theft. The date coincides with the enforcement of mandatory hardware passkeys at OpenAI Trusted Access for Cyber.

Our analysis

End of a long controlled withdrawal, not a break. GitHub had already imposed 2FA on maintainers of "high-impact" repositories and gradually expanded it. The real issue: CI/CD workflows and scripts that still rely on non-2FA personal access tokens - they will break at the switch. At D-45, the support queue explodes: that's where the operational risk is concentrated, not in 2FA itself. Note: hardware passkeys remain optional; GitHub keeps TOTP and SMS as entry-level, which leaves friction on the phishing axis - the gap in standard with frontier credentials remains clear (frontier-access-control).

To watch

• Behavior of CIs (GitHub Actions, Circle, self-hosted) and token managers at the switch.
• Impact on open source projects with occasional contributors - possible friction.
• Next step: passkeys by default or mandatory?