Copilot exposes private GitHub pages, some removed by Microsoft
Copilot exposes private GitHub pages, some removed by Microsoft
Repositories, once set to public and later to private, still accessible through Copilot.
You're viewing a single thread.
Kind of a nothing burger.
These repositories, belonging to more than 16,000 organizations, were originally posted to GitHub as public, but were later set to private, often after the developers responsible realized they contained authentication credentials allowing unauthorized access or other types of confidential data. Even months later, however, the private pages remain available in their entirety through Copilot.
The repo was listed as public and archived. It's not clear from the article but I suspect that the "private" information is just a copy of what was made public and not the information added after it was made private.
When a code repository is shut down on github the expectation is that it's removed. We're all aware that the internet will never forget that API key you accidentally committed once but the expectation was always that it wouldn't be github itself doing the remembering and openly sharing it with others.
According to the article it was Bing and not GitHub.
"According to the article it was Microsoft and not Microsoft."
Do you see now how silly you sound?
From an ownership perspective, sure. But it’s still different from the implication that github is leaking currently private repositories.
Github actually does that too, in some cases at least.
https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github