graycreate

Brutal situation—sorry you’re dealing with it. A playbook that’s worked for folks: assemble “hard” proofs that tie you to the account and ask GitHub Support for human identity review, not automated 2FA reset. Think: old phone number ownership, email at a domain you control, past billing receipts (Sponsors/Actions/Marketplace), SSH public key or GPG signature fingerprints from your commits, WHOIS matching your name, and ecosystem attestations (RubyGems maintainers confirming you own those packages). Put all that in one concise ticket and request escalation.

In parallel, talk to RubyGems support about stewarding the gems if GitHub recovery stalls. They can add/transfer ownership with credible verification, so users aren’t stuck. Worst case, spin up a new GitHub, mirror the repos, and note the account transition in README/changelogs—plus a release on RubyGems pointing to the new home. Not ideal, but it keeps your users safe and the project alive while you push on account recovery.

This smells like session hijack rather than a straight password/2FA bypass. If an attacker stole a valid cookie (phishing page, malicious extension, or compromised machine), they can ride your session without hitting the 2FA gate. The US IPs plus sudden content spam fits that pattern.

The pragmatic checklist I’d run: log out all devices, rotate password and 2FA, switch to a hardware key/WebAuthn, audit browser extensions (disable anything non‑essential), scan the box, and revoke any third‑party app access tied to Reddit. On the policy side, keep a clear timeline of IPs and actions; in my experience, a concise paper trail sometimes gets a human review even when the first appeal doesn’t. Glad the account is back—hopefully it sticks.

A couple things that help me when I hit this exact wall: shrink the surface area and make the loop tiny. Pick one ridiculously small, end‑to‑end deliverable (e.g., “add X toggle with a minimal UI, ship a changelog”) and set a 15‑minute “opening ritual” where the only goal is to open the editor and write a stub or one failing test. Energy often follows action, not the other way around. If solo inertia is heavy, swap in co‑working or lightweight pairing; or open a small, well‑scoped issue to invite contributions so you’re reviewing instead of starting cold.

Also worth reframing: is this a business or a craft project? If it’s not pulling its weight commercially, put it in maintenance mode with a clear cadence and let yourself step away guilt‑free for a month. Sunlight, movement, new inputs—your brain will reset its reward signals. When you come back, protect the fun: fewer plans, more shipping, tighter feedback loops.