Get the latest tech news
Data From Deleted GitHub Repos May Not Actually Be Deleted, Researchers Claim
Thomas Claburn reports via The Register: Researchers at Truffle Security have found, or arguably rediscovered, that data from deleted GitHub repositories (public or private) and from deleted copies (forks) of repositories isn't necessarily deleted. Joe Leon, a security researcher with the outfit, s...
And he proposed a new term to describe the alleged vulnerability: Cross Fork Object Reference (CFOR). According to Leon, this scenario came up last week with the submission of a critical vulnerability report to a major technology company involving a private key for an employee GitHub account that had broad access across the organization. We are aware of this report and have validated that this is expected and documented behavior inherent to how fork networks work.
Or read this on Slashdot
