What actually happens to forks
A repository’s visibility setting controls the original repository, not the copies other people have already forked. Changing visibility does not reach into those forks.
When a public GitHub repository becomes private, existing public forks are detached into a new network and remain public. Source
That means a public fork can keep showing code, commit history and author details after your own repository is private. Treat privatization as a change to your repository’s exposure, not as a recall of public copies.
What a visibility change does and does not do
| Action | What it affects | What it does not do |
|---|---|---|
| Switching the repository to private | The visibility of the original repository, in Settings, subject to permissions | Delete existing public forks or copies elsewhere |
| Changing a fork’s visibility | That fork only | Guarantee other forks or mirrors disappear |
| Editing or deleting files in your repository | Your repository’s current content | Erase history already published in forks |
Repository visibility can be changed in repository Settings, subject to account or organization permissions. Source
Privatization is not a deletion tool, an authorship eraser or a credential rotation. If secrets were committed, changing visibility does not make them safe; rotate them through the relevant service.
Pre-change self-review checklist
- List public forks. Open the repository’s fork list and note which forks are public and who owns them.
- Check published links. Search your own site, docs and package metadata for links to the repository or its raw files.
- Review commit identity. Check whether commit author names and email addresses are details you are comfortable having been public.
- Check other copies. Look for mirrors, vendored copies and archived snapshots that are outside GitHub’s fork network.
- Decide per fork. For forks you control, review their visibility separately; for forks you do not control, assume they stay public.
- Rotate exposed secrets. If credentials appeared in commits, rotate them rather than relying on the visibility change.
Decide before you flip visibility
| Situation | Sensible move |
|---|---|
| Public forks exist and contain sensitive code | Contact fork owners where possible; assume public copies remain |
| You own the forks | Review each fork’s visibility separately |
| Secrets were committed | Rotate credentials first |
| Only your repository is exposed | Visibility change in Settings may be enough, subject to permissions |
Where username exposure fits
A repository is one public surface among many. Your GitHub handle and commit identities may also appear on other sites, and a username search is a lead, not proof of ownership. TraceSeek checks 3,000+ platforms and offers a free first scan, with a stated scan time of 20-30 seconds. It does not change platform settings, see private information or verify identity. For a broader sweep of old accounts, see find forgotten online accounts; for how we frame evidence, see methodology.
Key facts
- When a public GitHub repository becomes private, existing public forks are detached into a new network and remain public.
- Repository visibility can be changed in repository Settings, subject to account or organization permissions.
- Making a repository private does not delete public forks, erase authorship or rotate exposed credentials.
- TraceSeek covers 3,000+ platforms and offers a free first scan.