So according to all the experts, the issue is 2-hour 2fa sessions? Makes sense, looking at the timeline. But then, it doesn't make sense to recommend having GH as a secure platform instead - its 2fa sessions are 

. (not to mention, PATs don't get 2fa challenges)

tech

privacy

devs

Axios supply chain attack post mortem

WeAreAllSatoshi

So according to all the experts, the issue is 2-hour 2fa sessions? Makes sense, looking at the timeline. But then, it doesn't make sense to recommend having GH as a secure platform instead - its 2fa sessions are **28 days**. (not to mention, PATs don't get 2fa challenges)