Hide Repository Activity View [Enhancement] #123659
Replies: 30 comments 9 replies
|
I guess it is not possible to hide only activity view in your repos, the only way is making your profile private. Differences between private and public profiles Achievements and highlights. You can make your account private easily going into your settings > public profile > scroll down until this: Hope that can help you! |
|
That settings affect only profile view, but not repository settings. Some additional clarification: |
|
I hope adding that feature, keeping your profile private is not a solution. |
|
100% agree with this. Many people expressed the same concerns in the original thread and as far as I can tell these went unanswered. Having control over this feature is a must, especially when developing in a private repo and later making it public. The most egregious is that it allows the public to view the diffs. There should at minimum be force pushes/delete diffs only viewable to the owner and/or the ability to turn this feature off completely, if not more granular control similar to the Actions workflow runs view where you can delete individual runs. Massive security and privacy risks, especially for people and orgs that are not fully aware of this "feature." |
|
I fully agree. It is really strange that it is considered a feature at all when even repo owner can't disable or limit it to certain people. Github should give option in global and repo settings to disable/limit globally or per repo respectively. I think this is a very valid demand from all github users. Due to this, I am considering shifting all repos to some other platform. |
|
We really do need a way to either delete/hide old activity and maybe even disable it or limit to maintainers. @thispaul |
|
+1 Deeply in need of this |
|
+1 need this |
|
|
|
I found one way to workaround this is to delete your repository and recreate (Note: YOU WILL LOSE ALL STARS AND ALL DATA related to the repo USE THIS WITH CAUTION |
|
@Mishin870 Do you wanna try it 😉 |
|
Hi, that's what I did |
|
I am also concerned that the Activity view enables someone to look through prior commits - even where a tool such as |
|
Accidentally noticed this menu today |
|
@jurakovic Thank you for raising this issue. I wonder if it helps to edit the title of this page to emphasize that it's a "security risk" and "privacy risk". The current title "Hide Repository Activity View [Enhancement]" may not be enough to raise the maintainers' awareness. Let me also @ mention one of the maintainers here. @queenofcorgis |
|
Thanks everyone for the great feedback and sharing use cases and your concerns, having all these details is incredibly helpful to our team so please keep them coming. As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. I don't have an update to provide on this and just to set expectations pinging me to check in while understandable likely isn't going to yield any new information from me. |
|
Why did the GitHub team decide to simply ignore this security suggestion? |
|
Finding out about this is definitely concerning. I imagine there are several people who have accidentally uploaded sensitive info to a repo, force-pushed over it, and now are under the mistaken assumption that that sensitive information is no longer public. I know I never would have assumed this is how GitHub works, because it's not how git works. git repos are just trees of changes; they aren't - and don't even necessarily benefit from being - immutable records. When I force-push, I intend and expect to overwrite the tree. I can understand having this an an opt-in feature if some people want it, but it is a security and privacy risk to have this feature silently enabled, with no ability to purge the history and opt out. |
|
+1 We should definitely be able to disable this. |
|
@queenofcorgis After about two years since this thread of discussion was started, and your comment
by you more than a year ago, can you share an update from inside of GitHub? |
|
This is crazy that it is still open and not implemented. Imagine if someone pushes an API key by mistake, it will always be there. The least is a huge privacy issue, as other people can see when and where on your public repos you have been working. |
|
I'm also going to chime in to add that this seems like an incredible value-for-effort feature, and the radio silence from GitHub is bizarre. |
|
2 years ago, I committed with the wrong email address and name, then forgot about it after doing a force push. |
|
There are so many people vibe coding these days, so im not sure designing it this way was a good idea This design seems like it could easily lead to personal information being exposed. |
|
Yeah, I don't get why they insist so much to have that feature, it is not very hard to see why it is so conflicting on this present implementation. In these days that everyone can pry information out of everything, leaving panels like that open is a security and trust problem |
|
with so many beginner developers entering the ecosystem, and even experienced Git users not realizing that their Github Activity is permanently preserved and publicly visible, this feels like a serious concern. I feel like we're going to see people upload something to GitHub with good intentions, assume a force push makes everything safe, and end up deeply regretting it :< Someone could simply ask an AI, "I accidentally committed my personal information. How do I remove it?" and it'd probably reply, "Just reset the commit and force-push your branch :)" |
|
GitHub must allow users to have control over their own data. At least if they don't want to remove or add visible/disable they must allow a way to delete them, purge them... This is not acceptable. |
|
old and 100% valid request. ignored for years like many other requests. shame shame |
|
I noticed that the "Activity" link redirects to different pages depending to the port view width. For large screens it's linked with the panel discussed herein (activity), for mobile screens with the "Insights" (pulse) page. Besides, in the mobile version, I don't see the way to access the activity via frontend. |
|
+1 and fully agreed that this is an insane security Issue. At the very least I'd want to be able to turn this feature off entirely, or restrict visibility to repo admins. Ideally, the Activity View should offer a Repo Admin tools for moderation, like what type of activities get recorded, detailed settings on who gets to see the view, plus ways to delete items from the log (similar to how you can already delete Runs of an Actions Workflow) and a quick way to clear it entirely. |
|
+1. This should be implemented. |
|
@queenofcorgis A gentle ping - because i) in 2025 you introduced yourself to this thread as staff member of GitHub and ii) I see your public contribution filed on November 9, 2026 here: is it possible for you to provide an update on behalf of GitHub / advance of this ticket filed in 2024? |
|
We are not going to allow disabling this feature. The concerns presented are all possible without this by extracting the git data that already exists in the repo, so it would be security by obscurity. You are welcome to continue to upvote and leave feedback, we do reevaluate these decisions from time to time. |
At least till April 2022, GitHub successfully run without it. See the comment below. |
|
yes, I am in Paris. I’m already |
So if somebody's personal data has been leaked once by accident—the data that can't be revoked or changed you know—let it stay there forever. Solid reasoning. I wonder how this plays into GDPR et al. |
|
Point 1: Who authors with
Point 2: I'm aware about project ChemBrows which (upstream) was archived in April 2022. Of course * Which requires additional resources to run, maintain, and update on GitHub's side compared to the simpler state of "it does not exist". |
|
Since Without |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Select Topic Area
Product Feedback
Body
Since discussion Repository Activity View #53140 is closed I don't know where else to ask/suggest this, so forgive me for my ignorance.
There are repository settings by which we can show or hide some features.
But there is no option to hide Repository Activity View.
As in above example, can we get setting to show or hide Activity View?
Edit, additional clarification:
IMHO this Repository Activity View poses security and privacy risk because it was introduced without possibility to hide it, and it shows deleted commits, branches, tags etc. If something is deleted, it is deleted for some valid reason and it should't be publicly visible if repository owner does not want it.
Thanks
All reactions