Outsider with no GitHub role deleted Dodo Payments' private repo, audit log shows
kingslyj · x · 2026-10-28
Dodo Payments co-founder Ayush Agarwal disclosed that an outside user with no membership, invite, or role in their GitHub org deleted one of the company's private repos. The audit log shows a single repo.destroy from the GitHub CLI (US IP, PAT-based access). Worse, the repo is missing from deleted repositories, so it cannot be restored. Agarwal publicly questioned GitHub about how this was possible, highlighting a potential flaw in GitHub's permission model.
More from Safety
- Write your customer breach-email template now, says lawyer who has watched panicked CEOs — mattshumer_ · 2026-10-28
- Emmett Shear's Softmax essay argues trust is a property of relationships, not models — Hidenori8Tanaka · 2026-10-28
- Dev open-sources an MCP server that deterministically checks SQL before your agent runs it — Greedy_Ad8932 · 2026-10-28
- The bigger PII risk in LLM apps isn't the provider — it's your logs, traces, and agent memory — abhi1510 · 2026-10-28
- OpenAI researcher: frontier AI ideas can't be patched for safety after the fact — willdepue · 2026-10-28
- Altman: models will find bugs 'outside the normal threat model' and patching won't save us — wfithian · 2026-10-28