Outsider deletes a private GitHub repo with no org access, and it's unrestorable
pramodk73 · x · 2026-10-28
Developer Ayush Agarwal reported that someone outside his GitHub org deleted a private repo with a single gh CLI repo.destroy — no membership, invite, or role, and nothing in org or enterprise audit logs. The repo isn't in deleted repositories, so it can't be restored. He's publicly asking GitHub how this is possible, and the incident highlights a potential serious blind spot in GitHub's permission and audit system.
Related event: GitHub permission flaw lets outsiders delete private repos(2 posts)→
More from Safety
- Top safety researcher admits misreading Anthropic report's 'AI safety is solved' headline — geoffreyirving · 2026-10-28
- Gmail's default-on AI email scanning faces class-action lawsuit; how to opt out — nikola_mr64990 · 2026-10-28
- Socket resurfaces mini shai-hulud lore: package hit via version range without touching latest — banteg · 2026-10-28
- eMudhra intermediate CA key compromise flagged P1 by Mozilla amid private comms — kingslyj · 2026-10-28
- Security researchers weigh whether AI-driven economic disruption will fuel global cybercrime — joshua_saxe · 2026-10-28
- CoDA enforces security policies inside diffusion LLM decoding, 0% injection success — nandofioretto · 2026-10-28