Regarding the issue of spam being sent via Discussions

[Larch-C]

Discussion Type

Product Feedback

Discussion Content

Hi everyone!

I've recently encountered an issue where people keep using GitHub's discussion feature to send massive amounts of spam. Specifically, they @ mention a large number of users and use GitHub's email system to send out bulk emails, which is quite annoying.

My current workaround is to modify my notification settings so it stops sending me emails. Can GitHub officially take action against these spamming accounts?

Thank you for your answer.

Here is the evidence:

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[syedsafeer]

Hi @Larch-C,
This 'Uniswap' recruitment spam is unfortunately a widespread issue across GitHub right now.
The best way to handle this is to report the discussion and the user profile directly to GitHub as 'Spam'. GitHub's safety team usually nukes these accounts pretty quickly once reported.
As a temporary fix to protect your inbox, you can go to your Notification Settings and change the 'Mentions' setting to only receive notifications from people you follow or participate with. This stops these bot-tags from triggering emails

[Larch-C]

Hi @Larch-C, This 'Uniswap' recruitment spam is unfortunately a widespread issue across GitHub right now. The best way to handle this is to report the discussion and the user profile directly to GitHub as 'Spam'. GitHub's safety team usually nukes these accounts pretty quickly once reported. As a temporary fix to protect your inbox, you can go to your Notification Settings and change the 'Mentions' setting to only receive notifications from people you follow or participate with. This stops these bot-tags from triggering emails

Thank you for your answer, I found it very helpful!

[YitzhakMizrahi]

Having experienced the same issue, I want to add something not yet mentioned that's important for community safety.
The notification settings tip from @syedsafeer is great for preventing future emails — but the 40+ people already tagged in these messages still have the phishing link sitting live in their inboxes right now, regardless of any settings change.
The core gap: GitHub's systems correctly and quickly ban these accounts, but the phishing URL delivered via notifications@github.com emails remains active and clickable indefinitely after removal. Someone checking email days or weeks later has no way of knowing the account was banned.
Suggested fixes for GitHub to consider:

1. Add a warning or redirect when links originate from banned accounts
2. Retroactively flag notification emails when source content is removed for abuse

The ban system is working well — this is purely about protecting people already hit by emails before the ban happened.

[syedsafeer]

Hi @YitzhakMizrahi, thanks for the mention! You’ve highlighted a very critical security gap. While changing settings helps prevent future spam, the phishing links already sitting in people's inboxes remain a major threat.
I completely agree with your suggestions. Having GitHub provide a warning or redirect for links from accounts that were later banned for abuse would be a massive improvement for community safety.

Great addition to the thread! @Larch-C, hopefully, GitHub takes note of these proactive security measures

[YitzhakMizrahi]

Thanks @syedsafeer Hopefully between this thread and the visibility it's getting, GitHub's team takes notice. The fix doesn't seem overly complex on their end but the impact for community safety would be significant. Appreciate you flagging the notification settings workaround too — that's a helpful stopgap in the meantime for anyone reading this.