GitHub Data Leak: Deleted and Private Repos Exposed via Forks

Think you're safe after deleting a repo or setting it to private? Think again. Turns out, anyone can access that data through forks. And it's not a bug—it's a feature, by design.

How does it work?

When you fork a public repository, GitHub retains all commits, including those made before the original repo was deleted or made private. Even if the original is gone, the fork still holds the data. And forks can be owned by anyone.

Truffle Security researchers tested this: they created a repo, pushed a secret commit, deleted it, and then found that commit in a fork. It works.

What this means for developers?

• Never store secrets (tokens, passwords) in repositories, even temporarily.
• If you accidentally commit a secret—consider it compromised. Revoke and rotate it immediately.
• Use tools like git filter-branch or BFG Repo-Cleaner, but remember: forks may retain history.

How to protect yourself?

Best practice is to prevent secrets from ever entering the repo. Use .gitignore, pre-commit hooks, and secret scanners. If a secret leaks, change it without delay.

METABYTE studio comment: This is a great reminder that security must be baked into your development workflow. Our team can help you set up CI/CD pipelines with automated secret scanning, so you can sleep soundly.