Detects bursts of GitHub API request events (api.request) from a single non-bot actor and source IP targeting sensitive routes (e.g., Actions/Dependabot environment secrets, public keys, git trees/contents, zipballs, organization repos, members, webhooks, installations, and personal access tokens). The rule groups by user.name and github.actor_ip within a 10-minute window and fires when there are at least 15 requests spanning at least 3 distinct sensitive routes, helping distinguish broad enumeration from a targeted probe. Automated actors or requests without an actor IP are excluded. This pattern typically precedes credential access or source code collection following token theft. Requires GitHub Enterprise audit log streaming with API Request Events enabled.