225
Anyone can Access Deleted and Private Repository Data on GitHub
(trufflesecurity.com)
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Community icon from opensource.org, but we are not affiliated with them.
(unforked repos that are forks are also affected.)
Yes, but only in very limited circumstances. If you:
then commits A and B are publicly visible, but commit C is not.
Per the linked Github docs:
Modifying the above situation to start with a public repo:
Commit B remains visible.
A version of this where step 3 is to take the fork private isn’t feasible because you can’t take a fork private - you have to duplicate the repo. And duplicated repos aren’t part of the same repository network in the way that forks are, so the same situation wouldn’t apply.
The second situation you listed is incredibly common, as the blog post explains.