GitHub Community
How to protect spam bot attacks in Discussion? #121439
-
Select Topic AreaQuestion BodyLast week we experience a massive spam attack in our discussion: https://github.com/orgs/dbeaver/discussions We cannot block spam bots by reporting every single one to GitHub (new ones created faster than we block them). DBeaver is a popular community with thousands of users. But we will have to close discussions completely next week. Is there any other possibility? |
Beta Was this translation helpful? Give feedback.
Replies: 11 comments 7 replies
-
|
One thing you could try is tightening up your account creation process, like adding email verification or CAPTCHAs. Another option might be using automated spam detection tools, although they might not catch everything. |
Beta Was this translation helpful? Give feedback.
-
|
@serge-rider, Admins can also block/ban individual users in the "comment options" dropdown; it also has an option to delete or hide all of that users posts (batch) to save time. |
Beta Was this translation helpful? Give feedback.
-
|
Unfortunately, these options are only available to comments. The initial post doesn't have this option. You have to block each one manually in the Moderation settings and delete the discussion, also manually (unless to spend time creating an automation, which is a huge waste of time). It would help if we had the option to select multiple discussions in the discussions list (just like with Issues) and perform actions like delete and block authors. |
Beta Was this translation helpful? Give feedback.
-
|
We are also suffering from this problem in our organization's discussions. I had to change all categories to the "Announcement" type to prevent users from posting. I am now painstakingly deleting thousands of posts one by one. |
Beta Was this translation helpful? Give feedback.
-
|
FYI folks, we have escalated this internally. I can't share timeline or make promises on their behalf, but the team responsible for mitigating GitHub-wide spam is aware of this new abuse vector and is prioritizing it alongside other GitHub-wide abuse vectors. |
Beta Was this translation helpful? Give feedback.
-
|
@serge-rider |
Beta Was this translation helpful? Give feedback.
-
|
This is great to hear! One problem I have encountered personally in trying to deal with spam Issues, Discussions, and Topics is that after reporting 4-5 users, I get blocked for "high number of reports" in rapid succession. I understand why there needs to be a cooldown for reporting user accounts, but that means that that account can only be blocked from the organization, while still operating elsewhere on GitHub. Perhaps using some other metrics to give "weight" to the report would help? As in, if the age of the reported account is low, but the comment/issue/discussion activity is high, and the account is reported, it would have heavy weight. For long standing accounts, with mixed or sparse activity, maybe lighten the "weight" to avoid taking action on a real account (just one thought off the top of my head). I've opened a support ticket about this as well, but haven't heard back. We've experienced numerous instances where users with accounts only a few hours or days old, opening 20-30 discussions/issues in the repo. When there are 15-20 of these accounts, it means only one person can report ~1/4 of them before getting timed out. Seems a bit backwards and would be great to have some help from GitHub on this. |
Beta Was this translation helpful? Give feedback.
-
|
@Burhan-Q |
Beta Was this translation helpful? Give feedback.
-
|
Any updates on this? We're a newish 22k ⭐️ repo, and getting phishing/malware comments on every single new issue created. Pattern:
Github has become our biggest risk vector for users |
Beta Was this translation helpful? Give feedback.
-
|
Hi @0xSage , 👋🏻 We really appreciate you flagging this. The best route to get this to the proper GitHub team is to use our abuse reporting tools. Here's all the info: You can report behavior and content that violates community guidelines and terms. For this and any future incidents, please refer to the links above. Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
@0xSage what is the repo name / link? |
Beta Was this translation helpful? Give feedback.
-
|
Update:
Kudos to Github team for promptly shutting down the bot accounts. Incidence samples:
Repos: Long term, I'm wondering if a moderation tool like Discord, where mods can ban certain phrases/regex in Github issues/comments would be amazing. We're on Enterprise, so this would be a little feature we dont mind paying for. 🙏 |
Beta Was this translation helpful? Give feedback.
-
|
@jricciardi @LiteBrite82 https://github.com/microsoft/vscode-discussions/discussions/ is being badly affected by this problem. It would help if repo owners could block access from GH accounts that are "new" or that don't have an established reputation of non-recent contributions to other repos. |
Beta Was this translation helpful? Give feedback.
-
|
The issue is seen in winget-cli repo too: https://github.com/microsoft/winget-cli/issues?q=is%3Aissue%20state%3Aopen%20author%3Amindmasterzonk These spam bots create ticket immediately after account creation it seems. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @jricciardi @LiteBrite82 we're seeing this as well (newish repo - ~22k stars). Our PR's are being spammed. Any help here would be appreciated Examples - |
Beta Was this translation helpful? Give feedback.
-
|
One thing you could try is tightening up your account creation process, like adding email verification or CAPTCHAs. Another option might be using automated spam detection tools, although they might not catch everything. |
Beta Was this translation helpful? Give feedback.
-
How to protect against spam bot attacks in GitHub DiscussionsGitHub provides several built-in tools to reduce and control spam in Discussions, but there is no single “anti-spam switch”. Protection works best when you combine multiple controls. 1️⃣ Restrict who can create discussionsYou can limit participation to trusted users. Path: Options include:
This is the most effective way to stop bot-created discussions. 2️⃣ Use moderation toolsFor existing spam:
Hidden comments remain invisible to the public but preserved for moderation review. 3️⃣ Require account maturity (implicit protection)GitHub automatically limits actions for:
This protection is automatic and not configurable, but it helps reduce bot spam. 4️⃣ Disable links and markdown abuse (manual enforcement)Most spam relies on links. As a moderator:
5️⃣ Use GitHub Actions for monitoring (advanced)While Actions cannot block posts directly, they can:
Example use cases:
6️⃣ Add clear community rulesCreate a pinned discussion like:
Clear rules reduce repeat abuse and justify moderation actions. 7️⃣ Disable Discussions temporarily (last resort)If spam becomes unmanageable: |
Beta Was this translation helpful? Give feedback.
FYI folks, we have escalated this internally. I can't share timeline or make promises on their behalf, but the team responsible for mitigating GitHub-wide spam is aware of this new abuse vector and is prioritizing it alongside other GitHub-wide abuse vectors.