[HN Gopher] GitHub leaked names of private repositories
       ___________________________________________________________________
        
       GitHub leaked names of private repositories
        
       I just received the following email:  Hi [username],  We're writing
       to let you know that between January 2021 and September 2021, the
       following information about your repository was inadvertently made
       publicly viewable after being sent to a third-party vendor as part
       of metadata analysis of GitHub Pages sites; the name of the private
       repository and the GitHub username with ownership of the
       repository. No repository content or other private data was exposed
       as part of this incident.  User privacy and security are essential
       for maintaining trust, and we want to remain as transparent as
       possible about events like these. GitHub itself did not experience
       a compromise or data breach as a result of this event, nor did
       unauthorized users gain access to repositories. Read on for more
       information.  * What happened? *  GitHub learned from an internal
       discovery by a GitHub employee, that GitHub Pages sites published
       from private repositories on GitHub were being sent to urlscan.io
       for metadata analysis as part of an automated process. This
       internal process was implemented before the private GitHub Pages
       feature was released and provides metadata that is used during
       human review of potentially malicious or abusive GitHub Pages
       sites.  To view the name of the private repository on urlscan.io,
       you would need to have been looking at the front page of urlscan.io
       within approximately 30 seconds of the analysis being performed or
       have specifically searched using a query that would return the
       analysis in the search results.  * What information was involved? *
       The following URLs, but no content, were made publicly viewable:
       GitHub Pages URLs [link containing username and name of private GH
       repository]  * What GitHub is doing *  GitHub immediately began
       work on fixing the automated process that sends GitHub Pages sites
       for metadata analysis so that only public GitHub Pages sites are
       sent for analysis. Future analysis of public GitHub Pages sites
       will be unlisted from public view as an additional protection.  We
       also worked with the third-party vendor, urlscan.io, to delete all
       existing public records of private GitHub Pages sites generated
       from this situation.  * What you can do *  No action is required on
       your end; we have updated our systems and worked with our third-
       party vendor to ensure this data is no longer publicly viewable.
       Please feel free to reach out to us with any additional questions
       or concerns through the following contact form:
        
       Author : lukashed
       Score  : 16 points
       Date   : 2022-02-15 21:15 UTC (1 hours ago)
        
       | fsflover wrote:
       | https://news.ycombinator.com/item?id=30348980
        
       ___________________________________________________________________
       (page generated 2022-02-15 23:02 UTC)