Hi everyone,

Recently, I noticed that a bot named "turbobot-temp" is pushing to my private GitHub repository.

The repository is just a backup of all my projects, and I have no idea how this happened. Here's what I did: from the root, I removed all the sub .git folders, ran git init, and pushed everything to my private repository back in September (the first and only commit at that time).

However, on December 17th and 18th, I saw that someone had co-authored commits with me. After checking the git log, I realized it was a Vercel bot updating my Next.js apps (screenshot attached below).

Can someone explain how this bot appeared out of nowhere, gained access, and committed changes? I never added the bot, and it doesn’t show up in the repository settings.

Thank you in advance for your help!