How can a random user use GitHub's dedicated email address and notification system to send viruses and spam? Why is GitHub assisting in this? #190587
Replies: 7 comments 13 replies
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
|
Same here: https://github.com/Whitechabarrier/VStudioUpdate-56371/discussions |
Beta Was this translation helpful? Give feedback.
-
|
GitHub is not helping attackers intentionally. But like any large platform its notification system can be misused by scammers to send phishing or malware links. Recently, researchers confirmed this is happening in real campaigns. |
Beta Was this translation helpful? Give feedback.
-
|
🔴 1. How attackers abuse GitHub notifications GitHub has a built-in system that sends emails when: someone mentions you (@username) 👉 Attackers exploit this workflow: ⚙️ The trick: So the email: comes from GitHub (trusted domain) |
Beta Was this translation helpful? Give feedback.
-
|
It happened to me again, this is the second time. |
Beta Was this translation helpful? Give feedback.
-
|
Santurakifoundationfounder[Webmaster]• |
Beta Was this translation helpful? Give feedback.
-
|
GitHub does not provide a direct email-sending service, nor does it assist in spam or harassment. What you are experiencing is a known abuse pattern where malicious actors exploit GitHub’s notification relay system. The 🔍 How This Abuse WorksSpammers and harassers typically:
GitHub’s system triggers notifications based on activity, not sender intent. While GitHub runs automated rate-limiting, CAPTCHA, and abuse-detection systems, there is often a brief window before enforcement actions take effect. 🛡️ Immediate Actions You Can TakeFor your personal account:
For repositories you maintain:
Example: Basic GitHub Actions workflow to auto-close issues containing known spam keywords: name: Auto-moderate spam issues
on:
issues:
types: [opened]
jobs:
filter:
runs-on: ubuntu-latest
steps:
- uses: actions/github-script@v7
with:
script: |
const body = (context.payload.issue.body || '').toLowerCase();
const spamTerms = ['whatsapp', 'telegram', 'crypto giveaway', 'cheap meds'];
if (spamTerms.some(term => body.includes(term))) {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.payload.issue.number,
state: 'closed',
labels: ['spam']
});
}Note: Tune keywords carefully to avoid false positives. Consider pairing with third-party moderation tools like 📚 Official ResourcesGitHub continuously improves its detection pipelines, but the open nature of public repositories means determined actors will occasionally test boundaries. Consistent reporting, combined with repository-level interaction limits and notification filtering, remains the most effective defense. If abuse persists across multiple accounts, submit a detailed report via the Abuse form with repository URLs, timestamps, and notification headers for priority review. |
Beta Was this translation helpful? Give feedback.




Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Important
Please improve security and disable these actions, as we have previously requested.
🏷️ Discussion Type
Bug
Topic area
Profile
Body
How can a 2-week-old user harass us GitHub users? How can a random user harass anyone? How can a random user use GitHub's dedicated email address and notification system to send viruses and spam? Why is GitHub assisting in this?
Please improve security and disable these actions, as we have previously requested.
Thank you,
... (again?)
Beta Was this translation helpful? Give feedback.
All reactions