The GitHub security team responded to a critical vulnerability by closing the ticket
OrchidFiles reported a flaw that let anyone read private repo secrets. GitHub marked it duplicate, did not patch it, then banned the researcher.
A security researcher at OrchidFiles discovered that GitHub Actions secrets could leak across repository boundaries under specific race conditions. The flaw affected private repositories. The reporter included a working proof of concept. GitHub’s security team closed the ticket as a duplicate of an internal issue. They did not issue a CVE. They did not notify affected users. Six weeks later, the researcher published a detailed write-up because the bug was still exploitable. GitHub responded by banning the researcher’s account and removing the public disclosure. The vulnerability remained unpatched for months after the initial report.
What makes this weird
Most bug bounty programmes have a disclosure timeline. Ninety days is standard. If the vendor does not patch within that window, public disclosure is expected and often encouraged. GitHub runs a bug bounty programme but apparently does not follow its own rules when the findings are inconvenient. The researcher did not dump secrets. They reported through the official channel, waited, then published a technical analysis. That is textbook responsible disclosure. The account ban suggests GitHub treated criticism as a bigger threat than the actual vulnerability. The HN discussion is full of people who have had similar experiences with GitHub’s security team. One commenter mentioned reporting a credentials leak in GitHub Copilot’s training data and getting zero response. Another described a ticket closed as “not a security issue” that later became CVE-2023-12345.
The takeaway
If you run a bug bounty programme, closing tickets as duplicates without patching the underlying issue is not a security strategy. It is reputation management disguised as triage. The OrchidFiles case shows what happens when a platform decides that controlling the narrative matters more than fixing the problem. I would not trust a vendor that bans researchers for following their own disclosure policy. That is a red flag the size of a data centre.