---
title: "Anyone can Access Deleted and Private Repository Data on GitHub ◆ Truffle Security Co."
url: https://daily.dev/posts/anyone-can-access-deleted-and-private-repository-data-on-github-truffle-security-co--8sbc7b1xb
source_url: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github
type: article
source: "Hacker News"
published: 2024-07-24T19:33:08.355Z
updated: 2024-08-23T16:15:25.354Z
tags: ["security", "devops", "github", "data-protection", "version-control"]
reading_time: 8
upvotes: 59
comments: 6
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Anyone can Access Deleted and Private Repository Data on GitHub ◆ Truffle Security Co.

**[Hacker News](https://daily.dev/sources/hn)** · 8 min read · 59 upvotes · 6 comments

## Summary

Data from deleted and private repositories on GitHub can be accessed indefinitely due to the platform's architectural design. This vulnerability, termed Cross Fork Object Reference (CFOR), allows users to fetch commit data via known or brute-forced SHA-1 commit hashes, even if the repository or fork has been deleted. This issue can expose sensitive information and is inherent to how GitHub manages repository networks.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github>

## Community discussion

Top comments from developers on daily.dev.

**@corem96** · 4 upvotes

> holy git!

**@grantlinville** · 4 upvotes

> GitHub needs to be way clearer about how forks and repo deletion work. Wild!

**@donlamarr** · 0 upvotes

> pretty shocking are we saying that we cannot delete a private repo once it's been made public and when it's been forked? What is the solution? I looked at another article referenced within this one and it seems the jury is still out on it, or am I missing something?

**@ravenmarkus** · 0 upvotes

> Nothing seems secure out there

**@aamorim** · 0 upvotes

> Doesn't surprise me at all. I unknowingly forked a Github repo that had some copyrighted content in it. Some time later a received a DMCA strike demanding to remove the infringing content in 1 business day. I could not make the repo private ou delete-commit the file. The part where I should not make the repo private REALLY got my attention. This shit ain't private...

## Similar posts on daily.dev

- [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments
- [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments
- [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments
- [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments
- [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#github](https://daily.dev/tags/github), [#data-protection](https://daily.dev/tags/data-protection), [#version-control](https://daily.dev/tags/version-control)

[View this post on daily.dev](https://daily.dev/posts/anyone-can-access-deleted-and-private-repository-data-on-github-truffle-security-co--8sbc7b1xb)