Hide Repository Activity View [Enhancement]

[jurakovic]

Select Topic Area

Product Feedback

Body

Since discussion Repository Activity View #53140 is closed I don't know where else to ask/suggest this, so forgive me for my ignorance.

There are repository settings by which we can show or hide some features.

But there is no option to hide Repository Activity View.

As in above example, can we get setting to show or hide Activity View?

Edit, additional clarification:
IMHO this Repository Activity View poses security and privacy risk because it was introduced without possibility to hide it, and it shows deleted commits, branches, tags etc. If something is deleted, it is deleted for some valid reason and it should't be publicly visible if repository owner does not want it.

Thanks

[ViniciusMarins]

I guess it is not possible to hide only activity view in your repos, the only way is making your profile private.

Differences between private and public profiles
When your profile is private, the following content is hidden from your profile page:

Achievements and highlights.
Activity overview and activity feed.
Contribution graph.
Follower and following counts.
Follow and Sponsor buttons.
Organization memberships.
Stars, projects, packages, and sponsoring tabs.
Your pronouns.

You can make your account private easily going into your settings > public profile > scroll down until this:

Hope that can help you!

[jurakovic]

That settings affect only profile view, but not repository settings.

Some additional clarification:
IMHO this Repository Activity View poses security and privacy risk because it was introduced without possibility to hide it, and it shows deleted commits, branches, tags etc. If something is deleted, it is deleted for some valid reason and it should't be publicly visible if repository owner does not want it.

[raufzer]

I hope adding that feature, keeping your profile private is not a solution.
I have seen that GitHub users have been demanding this feature for over 3 years, but there has been no progress or help.

[daneski13]

100% agree with this. Many people expressed the same concerns in the original thread and as far as I can tell these went unanswered. Having control over this feature is a must, especially when developing in a private repo and later making it public. The most egregious is that it allows the public to view the diffs.

There should at minimum be force pushes/delete diffs only viewable to the owner and/or the ability to turn this feature off completely, if not more granular control similar to the Actions workflow runs view where you can delete individual runs.

Massive security and privacy risks, especially for people and orgs that are not fully aware of this "feature."

[ghost]

I fully agree. It is really strange that it is considered a feature at all when even repo owner can't disable or limit it to certain people. Github should give option in global and repo settings to disable/limit globally or per repo respectively. I think this is a very valid demand from all github users. Due to this, I am considering shifting all repos to some other platform.

[tirthpatell]

We really do need a way to either delete/hide old activity and maybe even disable it or limit to maintainers. @thispaul
It's huge security issue otherwise if someone mistakenly pushed something.

[espwangning]

+1 Deeply in need of this

[AaronMoroney]

+1 need this

[ameaninglessname]

Repository Activity View is a critical defect for private members of an orgnization.

[ameaninglessname]

I found one way to workaround this is to delete your repository and recreate (Note: YOU WILL LOSE ALL STARS AND ALL DATA related to the repo ⚠️)

USE THIS WITH CAUTION

[ameaninglessname]

@Mishin870 Do you wanna try it 😉

[Mishin870]

Hi, that's what I did
The repository was just created, so everything is fine

[jtmusson]

I am also concerned that the Activity view enables someone to look through prior commits - even where a tool such as git-filter-repo has been used to sanitise the git history.

[Mishin870]

Accidentally noticed this menu today
It's crazy how anyone can see my force pushes that I did to hide my commit history!
Now I'm afraid to commit anything to the repository
A way to turn this off would be really nice

[Watt1234k]

@jurakovic Thank you for raising this issue. I wonder if it helps to edit the title of this page to emphasize that it's a "security risk" and "privacy risk". The current title "Hide Repository Activity View [Enhancement]" may not be enough to raise the maintainers' awareness.

Let me also @ mention one of the maintainers here. @queenofcorgis

[queenofcorgis]

Thanks everyone for the great feedback and sharing use cases and your concerns, having all these details is incredibly helpful to our team so please keep them coming.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. I don't have an update to provide on this and just to set expectations pinging me to check in while understandable likely isn't going to yield any new information from me.

[etiamz]

Why did the GitHub team decide to simply ignore this security suggestion?

[kmantel]

Finding out about this is definitely concerning. I imagine there are several people who have accidentally uploaded sensitive info to a repo, force-pushed over it, and now are under the mistaken assumption that that sensitive information is no longer public. I know I never would have assumed this is how GitHub works, because it's not how git works. git repos are just trees of changes; they aren't - and don't even necessarily benefit from being - immutable records. When I force-push, I intend and expect to overwrite the tree.

I can understand having this an an opt-in feature if some people want it, but it is a security and privacy risk to have this feature silently enabled, with no ability to purge the history and opt out.

[DziubanMaciej]

+1

We should definitely be able to disable this.

[nbehrnd]

@queenofcorgis After about two years since this thread of discussion was started, and your comment

While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

by you more than a year ago, can you share an update from inside of GitHub?

[phaetto]

This is crazy that it is still open and not implemented. Imagine if someone pushes an API key by mistake, it will always be there.

The least is a huge privacy issue, as other people can see when and where on your public repos you have been working.

[nbehrnd]

@phaetto Not implemented, you say? «Back in the day»(TM), it was possible to work and push without a public mark on the corresponding activity monitor. For instance activity on some gnuplot color palettes here -- which wasn't done within one commit only.

[jxddk]

I'm also going to chime in to add that this seems like an incredible value-for-effort feature, and the radio silence from GitHub is bizarre.

[neinnew]

2 years ago, I committed with the wrong email address and name, then forgot about it after doing a force push.
and today I can still see that exact content in the Activity. The profile of another account is still linked to it, which I don’t want to make public in the context of that repository due to privacy concerns.
It’s truly surprising that there’s no way to manage this other than deleting the repository.

[soyuta]

There are so many people vibe coding these days, so im not sure designing it this way was a good idea
Isnt it risky for everything to show up in Activity?

This design seems like it could easily lead to personal information being exposed.
Less experienced users might assume that a force push will fix everything (and some may not even realize that the full commit history can still remain accessible) hmm, I think there should be some safeguards in place.

[phaetto]

Yeah, I don't get why they insist so much to have that feature, it is not very hard to see why it is so conflicting on this present implementation. In these days that everyone can pry information out of everything, leaving panels like that open is a security and trust problem

[soyuta]

with so many beginner developers entering the ecosystem, and even experienced Git users not realizing that their Github Activity is permanently preserved and publicly visible, this feels like a serious concern.

I feel like we're going to see people upload something to GitHub with good intentions, assume a force push makes everything safe, and end up deeply regretting it :<

Someone could simply ask an AI, "I accidentally committed my personal information. How do I remove it?" and it'd probably reply, "Just reset the commit and force-push your branch :)"

[CycloneRing]

GitHub must allow users to have control over their own data. At least if they don't want to remove or add visible/disable they must allow a way to delete them, purge them... This is not acceptable.

[nerdCopter]

old and 100% valid request. ignored for years like many other requests. shame shame M$.

[paduszyk]

I noticed that the "Activity" link redirects to different pages depending to the port view width. For large screens it's linked with the panel discussed herein (activity), for mobile screens with the "Insights" (pulse) page.

Besides, in the mobile version, I don't see the way to access the activity via frontend.

[ElRaptorus]

+1 and fully agreed that this is an insane security Issue.
That force pushes / deletions are even recorded like this in the first place, is already questionable. But the fact that this info is always visible to the entire world, unless you make the repo private, seems incomprehensible to me.
It basically makes contributing public repositories a No-Go, unless you really like to feel exposed.

At the very least I'd want to be able to turn this feature off entirely, or restrict visibility to repo admins.

Ideally, the Activity View should offer a Repo Admin tools for moderation, like what type of activities get recorded, detailed settings on who gets to see the view, plus ways to delete items from the log (similar to how you can already delete Runs of an Actions Workflow) and a quick way to clear it entirely.

[chozian]

+1. This should be implemented.

[nbehrnd]

@queenofcorgis A gentle ping - because i) in 2025 you introduced yourself to this thread as staff member of GitHub and ii) I see your public contribution filed on November 9, 2026 here: is it possible for you to provide an update on behalf of GitHub / advance of this ticket filed in 2024?

[nbehrnd]

We are not going to allow disabling this feature.

The concerns presented are all possible without this by extracting the git data that already exists in the repo, so it would be security by obscurity.

You are welcome to continue to upvote and leave feedback, we do reevaluate these decisions from time to time.

[nbehrnd]

We are not going to allow disabling this feature.

At least till April 2022, GitHub successfully run without it. See the comment below.

[GeorgeSapkin]

We are not going to allow disabling this feature.

The concerns presented are all possible without this by extracting the git data that already exists in the repo, so it would be security by obscurity.

So if somebody's personal data has been leaked once by accident—the data that can't be revoked or changed you know—let it stay there forever. Solid reasoning.

I wonder how this plays into GDPR et al.

[nbehrnd]

Point 1: Who authors with GitHub Community Admin here - a human user, an AI robot, an (elected) moderator who could use his / her GitHub handle like many here use?

---

The concerns presented are all possible without this by extracting the git data that already exists in the repo, so it would be security by obscurity.

Point 2: I'm aware about project ChemBrows which (upstream) was archived in April 2022. Of course git collects commit history by the sha265 sums (and then other data including dates and the edits). The issue to me and arguably many others is not that GitHub displays this part (example about the sequence of edits). However (at least) till then GitHub worked just fine without the extra activity monitor per project. This additional monitor* isn't needed for GitHub to function (see for instance this empty one here despite 0.5k+ commits retrained), nor wanted while retaining continuous visibility (stars, maintaining forks to allow PRs by others, etc).

* Which requires additional resources to run, maintain, and update on GitHub's side compared to the simpler state of "it does not exist".

[nbehrnd]

Since git is (one of) the core engines to run repositories, I became curious how «activity» of a project is managed elsewhere. Without relation (so far) to this particular repository, I found this one on codeberg.org

Without git clone and subsequent local in-depth git history / project archeology, this is about as much I think is necessary / useful for an initial check "is this particular project (still) maintained?". And the GUI doesn't go more into detail if you actually establish an account and log-in into the host's web site (nor that I would see a benefit, nor need).