ok update on the deleted repo thing, since it kind of blew up
first, some context on why i posted it like that. there have been so many security incidents lately that my brain is basically stuck in alert mode. so when i saw a stranger in our audit log deleting a private repo, i assumed the worst.
we figured out what happened. nobody hacked us, and it wasn't a github bug.
that repo was a private fork of a repo owned by
@StainlessAPI, the company that generated our SDKs. our entire SDK pipeline ran on it.
Stainless got acquired by
@AnthropicAI back in may. and on october 27, with zero heads-up to us, someone there deleted their copy of the repo.
turns out when you delete a private repo on github, every private fork of it gets deleted too. same request, under two seconds. and our audit log shows the person who deleted *their* repo as the one who deleted *ours*. that's why it looked like a random outsider walked into our org and nuked something.
no email. no "hey, we're cleaning these up, grab a copy." just gone, along with the production repo behind every one of our SDKs.
github support walked us through all of it within a day, which, genuinely, thank you.
one ask though
@github: put this in the audit log. right now the event for our repo just says "repo.destroy" by an outside user. if it said "deleted because upstream fork parent X was deleted", we'd have understood it in two minutes instead of spending a night thinking we'd been breached.
we had a local clone, so we pushed it back up as a standalone repo and the SDKs are running again.
if you were a Stainless customer and you've got anything living as a private fork of one of their repos, go detach it today. it takes ten minutes. their delete is your delete.
