GitHub Privacy Considerations for Sensitive Projects

A public Git repository exposes its code by design. It may also expose the people behind it. Commit names, email addresses, timestamps, account activity, and network records can connect a pseudonymous project to a real person. GitHub documents each part of that record in its privacy and legal-request policies.

Microsoft completed its acquisition of GitHub in 2018. That ownership is relevant, but it does not prove that every Microsoft government request involves GitHub. The useful question is narrower: what does GitHub collect, what can become public, and what can GitHub disclose when it receives valid legal process?

GitHub collects more than repository content

GitHub's General Privacy Statement says service-usage information can include IP address, device information, session details, request dates and times, device type and ID, operating system, application version, and information about repository contributions. GitHub also says it infers a general geographic location from an IP address.

The statement does not say that every field is collected for every request or retained forever. Retention depends on the type of data, the service, and legal or operational needs. That distinction matters. The documented risk is collection and possible linkage, not a claim that GitHub keeps a permanent browser fingerprint for every visitor.

Git history can identify contributors

Git commits contain an author name, author email address, and timestamp. Those fields travel with the repository history. Changing an email setting later does not rewrite old commits. GitHub's commit-email documentation confirms that a new address applies to future commits and that earlier commits remain associated with the old address.

GitHub provides a noreply address for people who enable email privacy. This prevents a personal address from appearing in future commits. It does not hide the GitHub account, remove timestamps, or stop GitHub from recording service-usage data.

What GitHub says it can disclose

GitHub publishes Guidelines for Legal Requests of User Data. The policy separates account information, access logs, and private content by the legal process required.

• A valid subpoena or similar process can reach specified account information such as names, email addresses, billing information, registration dates, and IP details tied to registration or a specified event.
• A court order or search warrant can reach account access logs, including IP-specific analytics, browsing history, and security access logs.
• A search warrant can reach private account content, including private repository source code, secret Gists, collaboration records, issues, wikis, and communications.

GitHub says it will notify affected users unless notification is prohibited by law or court order. It also says it will not disclose location-tracking data such as IP logs without a valid court order or search warrant, and will not disclose private content without a valid search warrant. These are GitHub's published policies. A project with serious legal exposure should read the current policy rather than rely on a general claim about US surveillance law.

GitHub and Codeberg have different data policies

Codeberg is a Forgejo-based software forge operated by Codeberg e.V., a registered nonprofit association in Berlin. It is not anonymous infrastructure. Its current privacy policy says it processes technical metadata including IP address, browser, operating system, access time, requested URLs, and referrer.

The difference is in the stated handling. Codeberg says IP addresses are truncated when stored in logs and technical metadata is not retained for more than seven days unless German law requires longer storage. GitHub's general statement describes retention by purpose and legal need rather than promising one short limit for service-usage logs.

Reduce exposure without breaking the project

1. Set a separate commit identity. Use a project-specific name and GitHub's provided noreply address. Check with git config user.name and git config user.email before the first commit.
2. Inspect existing history. Search all branches and tags for personal email addresses, names, API keys, and paths. Removing a secret from the latest file does not remove it from Git history.
3. Separate accounts. Do not reuse recovery addresses, profile images, usernames, payment details, or SSH keys from a personal identity.
4. Limit private material on hosted forges. Keep source that must remain undisclosed on systems you control. A private repository is access-controlled storage, not immunity from legal process or account compromise.
5. Protect the account. Use a unique password and phishing-resistant two-factor authentication. Save recovery codes offline.
6. Document the threat model. Decide whether you need protection from public correlation, platform access, account takeover, civil discovery, or government process. Each requires different controls.

Moving a repository to Codeberg

Codeberg's migration documentation supports GitHub imports. Its migration tool can copy Git data and selected metadata such as issues, labels, releases, milestones, and a wiki. Importing private content or metadata requires an access token from the source service. Delete that token after the migration.

A plain Git mirror is another option. Create the target repository, add it as a remote, and push the required branches and tags. Verify branch protection, releases, CI secrets, webhooks, deploy keys, and issue history separately. Do not assume a successful code push copied the rest of the project.

Codeberg reduces dependence on a US corporate host and publishes a shorter log-retention policy. It does not remove the need for identity separation, careful commit metadata, account security, or local control of truly sensitive material.

Sources

• GitHub General Privacy Statement
• GitHub Guidelines for Legal Requests of User Data
• GitHub: Setting your commit email address
• GitHub: Microsoft acquisition completed
• Codeberg Privacy Policy
• Codeberg: What is Codeberg?
• Codeberg repository migration documentation