Anyone can Access Deleted and Private Repository Data on GitHub ◆ Truffle Security Co.
trufflesecurity.com
You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way.
  • nao@sh.itjust.works
    124·
    2 months ago

    After reviewing the documentation, it’s clear as day that GitHub designed repositories to work like this.

    Sounds like they wanted to find a problem but it turned out to be a feature.

    • ShadowA
      123·
      2 months ago

      Yeah, pretty much everyone agrees that once something goes to git it lasts forever.

      The fact they call out that secret keys must be rotated if committed, makes me think they thought just deleting a commit was enough 🤦