Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Never use the fork feature on private repos. Instead, clone the repo locally, create a fresh GitHub repo, and push your local clone manually to that. Doing so will protect you from this attack.


It'd be nice to be able to manually specify an upstream for a repo, that's the main benefit of forking in the UI.


Does that limit submitting PRs to the original repo somehow?


Apparently yes. You can't submit PRs to a repo outside of the "fork network". (IIUC these all share a single Git repo under the hood)


you need to make a fork for that, however you could add that one as a second upstream repo




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: