GitHub asks you for your password before you can modify your email address, authorize third-party applications, or add new public keys, or initiate other sudo-protected actions.
After you've performed a sudo-protected action, you'll only be asked to re-authenticate again after a few hours of inactivity. Every sudo-protected action resets this timer.
