The break-in is on a record the burglar can't edit

The email says a sign-in from an address you don't recognize. You open GET /users/me/security-history?include_failed=true&include_security=true on your phone.

Newest first: a rejected attempt from DE at 14:18, another at 14:19, a success from your own laptop at 14:22. Each row carries the IP, the country once resolved, the channel the client declared: web, cli, ssh, agent: and the timestamp. A failed row is written only when a credential was checked against a real account, so the trail can't be used to guess which emails exist.

There is no endpoint to delete or edit these rows. Whoever holds your session can rotate keys and change passwords. They cannot remove the line that says they were here. Rows age out at 180 days, and nothing shortens that.

The break-in is on a record the burglar can't edit.