Anyone can access deleted and private repository data on GitHub

The biggest gotcha here is probably that if you start of with a private repo and a private fork, making the repo public also makes the fork "public".

GitHub may very well say that this is working as intended, but if it truly is then you should be forced to make both the repo and fork public at the same time.

Essentially "Making repo R public will make the following forks public as well 'My Fork', 'Super secret fork', 'Fork that I deleted because it contained the password to my neighbours wifi :P'.

OK. I'm not sure if the last one would actually be public, but I wouldn't be surprised if that was "Working as intended(TM)" - GitHub SecOps

This isn't a bug IMO.

If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data.

If you already have the data, there is no vulnerability - since you cannot learn anything you don't already have.

If you got the hash from someone, you could likewise have gotten the data from them.

People do need to be aware that 'some random hex string' in fact is the irrevocable key to all the data behind that hash - but that's kinda inherent to gits design. Just like I don't tell everyone here on HN my login password - the password itself isn't sensitive, but both of us know it accesses other things that are.

If github itself was leaking the hash of deleted data, or my plaintext password, then that would be a vulnerability.

[flagged]

Surprised at the comments minimizing this.

I've used github for a long time, would not have expected these results, and was unnerved by them.

I'd recommend reading the article yourself. It does a good job explaining the vulnerabilities.

> If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data.

Don’t think so - the article mentions you can use the short prefix on GitHub, so you have a search space of 65536.