GitHub is notifying contributors that two-factor authentication (2FA) will become mandatory on September 2, 2026 at 00:00 UTC. The email targets accounts already enrolled in 2FA that meet current criteria.

No action is required from recipients. After the deadline, users will no longer be able to disable 2FA. If 2FA is disabled before then, GitHub.com access will be restricted until re-enabled. This email and a dismissible banner are the only notifications.

The move aims to strengthen the software supply chain security. GitHub emphasizes this is a team effort and 2FA enrollment is an impactful step. Users can review security events via the security audit log or contact support for issues.