Anyone can access deleted and private repository data on GitHub (trufflesecurity.com)

Article summary

GitHub's repository architecture allows access to deleted and private repository data, including commits from deleted forks and private repositories, which can be accessed via commit hashes. This behavior is intentional and documented by GitHub, but may not be well understood by average users. The issue has significant implications for organizations using GitHub, as sensitive data may be inadvertently exposed. This vulnerability is referred to as a Cross Fork Object Reference (CFOR) vulnerability.

Main themes

• GitHub security
• Repository architecture
• Data exposure
• Cross Fork Object Reference (CFOR) vulnerability
• Bug bounty programs

What commenters say

• The behavior of GitHub's repository architecture is surprising and counterintuitive to many users, who expect private repositories to be secure.
• GitHub's documentation of this behavior does not excuse the fact that it is a security risk, and the company should take steps to mitigate it.
• The issue is not just a matter of user education, but also of GitHub's responsibility to provide a secure platform for its users.
• Paying out bug bounties for known issues can create bad incentives and encourage unnecessary reports, but not documenting security issues can also be problematic.
• The fact that GitHub does not consider this a security vulnerability and does not pay out bug bounties for it is seen as unfair by some, who argue that it is still a significant security risk.
• The design of GitHub's repository architecture is flawed and needs to be changed to prevent data exposure, rather than just documenting the behavior.
• The bug bounty program is not just about finding vulnerabilities, but also about encouraging responsible disclosure and collaboration between companies and security researchers.