# Continue with GitHub — without giving it your Self

**GitHub can carry an encrypted identity backup. GitHub login alone cannot unlock it, recover all cursor work, or become your Cursors identity.**

The current sign-in screen keeps GitHub in the recovery section, after the local Self and optional public mailbox. You do not need GitHub to try local notes, save contacts, or inspect the cockpit.

## Check availability before starting

Open **SIGN IN + RESUME** and read the service strip. GitHub controls remain disabled while the deployment is paused, unreachable, or does not report the configured GitHub recovery service.

A healthy static website does not imply an enabled GitHub session API. This guide does not ask you to register an OAuth application, paste a personal token, supply an API key, or bypass a release gate.

## Save an encrypted recovery copy

1. Create or unlock your existing Self with a compatible passkey. Keep its encrypted file export as an independent recovery copy.
2. Choose **CONTINUE WITH GITHUB**. Use the GitHub authorization page opened by the configured service, then return to the sign-in screen. Check the displayed account rather than assuming sign-in completed.
3. Choose **SAVE ENCRYPTED RECOVERY**. This uploads the encrypted vault and its signed recovery horizon. Wait for the explicit gist-write result.
4. **PUBLISH SAFE HYDRATION README** is separate and optional. It publishes public recovery references, not an unlocking secret. Skip it when you do not want those public associations.

Do not treat “connected to GitHub” as “backup successfully written.” Those are different operations, with different failure modes.

## Review the requested permissions

The intended GitHub App permission is **Gists: read and write**. This integration does not request repository, organization, Actions, issue, pull-request, email, or SSH-key permissions. Check the actual GitHub authorization screen before approving; cancel unexpected access. The configured App and its consent screen still require operator verification.

## What GitHub can see

A GitHub **secret gist is unlisted, not private**. Someone with its URL can access it. The encrypted vault must remain confidential without relying on obscurity of that URL. The gist and public README can also reveal metadata, associations, timestamps, and public identity references.

The gist is not a complete archive of your notebook, address book, cursor checkpoints, receipts, or every program state. Back up those separately using their appropriate verified export paths. Cursors' canonical identity and authority do not derive from a GitHub username.

## Restore carefully, before you lose the original

Use an empty compatible browser profile on the correct Cursors origin. Connect the same GitHub account and choose **RESTORE ENCRYPTED SELF**. The browser fetches and verifies the recovery files and signed horizon before importing the encrypted vault. An existing local Self is not silently overwritten.

The result should be **locked**. Unlock using the original compatible credential. Passkey recovery requires the credential and environment to reproduce the PRF result; a newly created passkey or a different fork's origin is not equivalent. Cross-device synced credentials are not a universal promise of compatibility.

Compare the restored public identity with the original. Keep the original device and backup until you have completed that test. A successful gist fetch is not successful decryption, and successful decryption is not authority to resume arbitrary cursor work.

## Disconnect means disconnect

**DISCONNECT** removes the service's GitHub session. It does not remove your local Self or delete existing gists. Deleting remote recovery material is a separate deliberate action; do not imply it happened just because a session ended.

A legacy passphrase-protected vault still needs its original supported unlock path. This newcomer screen deliberately does not collect passphrases or private keys.

See [Resume Your Cursors](resume-your-cursors.md) for the complete persistence map, and [Local Identity Vault](local-identity-vault.md) for implementation details.