This is why for private and business projects, we don't use GitHub, we use Amazon CodeCommit.
Anyone can access deleted and private repository data on GitHub
51–60 of 394 posts
Re: Anyone can access deleted and private repository data on GitHub
#52Users should never be expected to know these gotchas for a feature called "private", documented or not. It's disappointing to see GitHub calling it a feature instead of a bug, to me it just shows a complete lack of care about security. Privacy features should _always_ have a strict, safe default. In the meantime I'll be calling "private" repos "unlisted", seems more appropriate
Yep, I see GitHub as "public only" hosting, and if I want to host something private, I will choose another vendor.
The noted issue looks to be applicable to forks only, not to all private repos.
Re: Anyone can access deleted and private repository data on GitHub
#53I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…
It would not even be that hard to fix it; private forks should always just be automatically copied on first write. You might lose your little link to the original repo, but that's not as bad as unintentionally exposing all your future content.
Yup, we can close the thread and ack that GitHub does not care.
Re: Anyone can access deleted and private repository data on GitHub
#54I reported this on their HackerOne many years ago (2018 it seems) and they said it was working as intended. Conclusion: don't use private forks. Copy the repository instead. Here is their full response from back then: > Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing the finding we have determined it is a known low risk issue. We may make this functional…
I reported a different security issue to github, and they responded the same (although they ultimately ended up fixing it when I told them I was going to blog about the "intended behavior").
What "intended behaviour" was that, specifically?
Re: Anyone can access deleted and private repository data on GitHub
#55Most of this report is just noise. GitHub repos are public. Public stuff can be shared. Public stuff shared previously and then deleted is "still available", but it was shared previously and not really subject to security analysis.
The one thing they seem to be able to show is that commits in private branches show up in the parent repository if you know the SHAs. And that seems like a real vulnerability. But AFAICT it also requires that you know the commit IDs, which is not something you can get via brute forcing the API. You'd have to combine this with a secondary hole (like the ability to generate a git log, or exploiting a tool that lists its commit via ID in its own metadata, etc...).
Not nothing, but not "anyone can access private data on GitHub" as advertised.
Re: Anyone can access deleted and private repository data on GitHub
#56Earlier quoted context omitted.
Yep, I see GitHub as "public only" hosting, and if I want to host something private, I will choose another vendor.
Which vendors work best for private projects?
You could consider GitLab.. though this only seems to affect private forks of public repos.
Re: Anyone can access deleted and private repository data on GitHub
#57Really the only semi-interesting part of this is "if you make a private repo public, data from other private forks might be discoverable", but even that seems pretty minor, and the best practice for taking private repos public is to copy the data into a new repo anyway.
Even after a private repo is made public, it's common practice for new functionality to be worked on in private until it's ready.
Re: Anyone can access deleted and private repository data on GitHub
#58Microsoft: It's the EUs fault!
Also Microsoft: It's a feature!
Re: Anyone can access deleted and private repository data on GitHub
#59A “delete” means it should be gone forever from the service it was removed from.
“Private” means it should only be available to specific involved parties only.
If you implement any other behavior to these concepts you are implementing anti patterns.
We need to be precise and consistent in the wording of the functions we are providing in order to ensure we easily can understand what is going on, without having to interpret documentation to be able to fully understand what is going on.
Re: Anyone can access deleted and private repository data on GitHub
#60[dead]