https://news.hada.io/topic?id=16001 (๋ฒˆ์—ญ)

https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github (์›๋ฌธ)


๋Œ€์ถฉ public์ธ์ƒํƒœ์—์„œ fork๊ฐ€ ๋– ์ง€๊ฑฐ๋‚˜ ํ•˜๋ฉด ๋‚˜์ค‘์— private์œผ๋กœ ๋ฐ”๊ฟ”๋ดค์ž ๋‚ด์šฉ ๋‹ค ๋ณผ ์ˆ˜ ์žˆ๋‹ค๋Š” ๋‚ด์šฉ

๋˜๋Š” upstream์ด public์œผ๋กœ ์ „ํ™˜๋˜๋ฉด ๊ฑฐ๊ธฐ์„œ forkํ•œ private repo๋„ ๋‚จ์—๊ฒŒ ๋ณด์—ฌ์งˆ์ˆ˜ ์žˆ๋‹ค๋Š” ๋‚ด์šฉ


์ธ๋ฐ ์ •ํ™•ํ•œ ๋‚ด์šฉ์€ ๋ฒˆ์—ญ๋ฌธ์ด๋‚˜ ์›๋ฌธ์„ ์ฝ์–ด๋ณด์‹œ๋Š”๊ฑธ ์ถ”์ฒœ๋“œ๋ ค์š”


๊ณต๊ฐœ์ ์ธ ํ”„๋กœ์ ํŠธ๋ฅผ ์ƒ์šฉ์œผ๋กœ ์ „ํ™˜ํ•˜์…จ๋‹ค๊ฑฐ๋‚˜ ํ•˜๋ฉด ํ•œ๋ฒˆ ์ฒดํฌ๋ฅผ ํ•ด๋ณด์…”์•ผํ• ๋“ฏ ํ•ด์š”