219

Anyone can Access Deleted and Private Repository Data on GitHub (trufflesecurity.com)

submitted 3 months ago by communism@lemmy.ml to c/opensource@lemmy.ml

41 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[-] visor841@lemmy.world 51 points 3 months ago* (last edited 3 months ago)

While this is still a massive problem, it does require a public fork at some point. So if you have a private repo that has never had a public fork, you should be safe.

[-] Aatube@kbin.melroy.org 11 points 3 months ago

(unforked repos that are forks are also affected.)

[-] hedgehog@ttrpg.network 7 points 3 months ago

Yes, but only in very limited circumstances. If you:

fork a private repo with commit A into another private repo
add commit B in your fork
someone makes the original repo public
You add commit C to the still private fork

then commits A and B are publicly visible, but commit C is not.

Per the linked Github docs:

If a public repository is made private, its public forks are split off into a new network.

Modifying the above situation to start with a public repo:

fork a public repository that has commit A
make commit B in your fork
You delete your fork

Commit B remains visible.

A version of this where step 3 is to take the fork private isn’t feasible because you can’t take a fork private - you have to duplicate the repo. And duplicated repos aren’t part of the same repository network in the way that forks are, so the same situation wouldn’t apply.