sensitive data

In this article

GitHub Private Information Removal Policy

Copy markdown

In this article

We offer this private information removal process as an exceptional service only for high-risk content that violates GitHub's Terms of Service, such as when your security is at risk from exposed access credentials. This guide describes the information GitHub needs from you in order to process a request to remove private information from a repository.

What is Private Information?

For the purposes of this document, “private information” refers to content that (i) should have been kept confidential, and (ii) whose public availability poses a specific or targeted security risk to you or your organization.

"Security risk" refers to a situation involving exposure to physical danger, identity theft, or increased likelihood of unauthorized access to physical or network facilities.

Private information removal requests are appropriate for:

• Access credentials, such as user names combined with passwords, access tokens, or other sensitive secrets that can grant access to your organization's server, network, or domain.

• AWS tokens and other similar access credentials that grant access to a third party on your behalf. You must be able to show that the token does belong to you.

• Documentation (such as network diagrams or architecture) that poses a specific security risk for an organization.

• Information related to, and posing a security risk to, you as an individual (such as social security numbers or other government identification numbers).

Private information removal requests are not appropriate for:

• Internal server names, IP addresses, and URLs, on their own. You must be able to show that their use in a particular file or piece of code poses a security threat.

• Mere mentions of your company's identity, name, brand, domain name, or other references to your company in files on GitHub. You must be able to articulate why a use of your company's identity is a threat to your company's security posture.

• Entire files or repositories that do not pose a specific security risk, but you believe are otherwise objectionable.

• Requests to remove content that may infringe your or your organization's copyright rights. If you have questions about how GitHub handles copyright-related matters or would like to report potentially infringing content, please review our DMCA Takedown Policy. The private information removal process is generally not intended for the removal of full files or repositories — only for the specific pieces of private information in those files. While there may be cases where files are filled entirely with private information, you must justify the security risk for the removal of such files, and this may increase the time required to process your request.

• Trademark disputes. If you have questions about how GitHub handles trademark-related matters or would like to report content containing your organization's trade or service marks, please review our Trademark Policy.

• Privacy complaints. If you wish to access, transfer, change, or delete your personal information on GitHub, please contact us via our Privacy contact form.

• Content governed by our Community Guidelines, such as malware or general-purpose tools. If you have questions about our Community Guidelines or believe that content on GitHub might violate our guidelines, you can contact us through the GitHub Support portal to report content.