Remove a GitHub Repository That Names You

GitHub removes a repository or gist that names you only when it breaks a specific GitHub policy, such as posting private information about you, harassing you, or copying work you own. Being named in public code is not, on its own, a violation. The route that works is to report the content under the policy it actually breaks, treat forks and cached copies as separate problems, and ask the search engine for removal once GitHub has acted.

GitHub pages are indexed like any other site, so a repository that lists your name beside an address, a gist that quotes a private message, or a profile impersonating you can surface in a search on your name. Each problem sits under a different GitHub policy with a different standard of proof, and choosing the wrong one is a common reason a report goes nowhere.

This guide is based on GitHub's published policies and help pages as read for this article. GitHub's report forms were not opened, so the fields they ask for are not described. Check the live forms before you file. This is information, not legal advice.

The short version

GitHub acts on policy violations: harassment, doxxing and invasion of privacy, impersonation, copyright, trademark and high-risk private information. A repository that is merely about you, or accurate and public, usually does not qualify.
Report repositories and users through the report options on GitHub itself. Use the DMCA process only if you own the copyright in the material. Use the private information policy only for content that creates a specific security risk.
Forks, copies in other repositories, cached views and gists live on after the original is removed unless each is reported or removed on its own.
Search results are a separate step. Once the GitHub page is gone, ask the search engine to refresh or remove the result.

GitHub removes content that breaks its rules, not content that merely names you

GitHub's Acceptable Use Policies are the standard a report is measured against. They bar content that harasses or abuses another individual or group, content that violates the privacy of a third party "such as by posting another person's personal information without consent", and content that impersonates a person or entity. They also say misuse of personal information is prohibited.

The test is the behavior or the data, not the fact that your name appears. GitHub's separate Doxxing and Invasion of Privacy policy says GitHub will take context into account, including whether the content is publicly available elsewhere, and that publicly available content is not necessarily a violation. The same policy adds that sharing public information to harass or incite abuse can fall under the harassment rules, and the harassment policy says criticizing public figures, projects or topics of public interest does not necessarily fall under it.

Before you file, write one sentence that names the rule broken and the exact item that breaks it. "This README publishes my private phone number" is a report. "This repository is about me and I dislike it" is not.

Which GitHub route fits your situation

GitHub's content removal page says it cannot help you determine which policy fits, and recommends independent legal counsel if you are unsure whether something is copyright, trademark or private information. The table below is a decision aid built on the policies read for this guide.

What the content is	Route	Standard	Typical fit
Your address, private phone or email, ID numbers, non-consensual photos	Report as doxxing or invasion of privacy	Private information posted without consent	Strong when the data is on the page
Targeted attacks, abuse, intimidation aimed at you	Report as harassment or abuse	Conduct aimed at a person	Strong when it is targeted, weak for criticism
A profile or repository pretending to be you	Report as impersonation	Content that impersonates a person or entity	Strong with proof of who you are
Your own text, photos or code copied	DMCA takedown notice	You own the copyright, sworn statement	Only for protected expression
Credentials or ID numbers creating a security risk	Private information removal policy	Specific, targeted security risk	Narrow, an exceptional service
Accurate public facts, an unflattering opinion, a news link	No GitHub route, go to the author or the search engine	Not a violation as such	Reports usually fail

Defamation, meaning a false statement of fact that harms reputation, has no GitHub removal policy among those read here. A false accusation in a README is reportable mainly if it is also harassment or impersonation, or through a court process outside GitHub. The defamation route depends on your country and is covered on our remove negative content page.

What counts as doxxing or invasion of privacy on GitHub

GitHub's Doxxing and Invasion of Privacy policy lists the data it treats as private: personal, private email addresses and phone numbers, physical addresses and other private location information, bank and card details, national ID numbers, passwords, voter information, medical information or biometric data, and other private information that may pose a safety or security risk. It also covers photos or videos taken or distributed without the subject's consent, especially where they create safety risks such as intimidation or harassment.

Two details shape a report. The first is private versus findable: the policy weighs whether the content is publicly available elsewhere, so a business number printed on your company site is a weaker report than a mobile number that never appeared publicly. The second is specificity: point to the file, the line or the comment, because "this repository exposes my information" is hard to act on.

How to report a repository, a user or a gist

GitHub's help page for reporting abuse gives the paths for repositories and users. For a repository, open its main page, find the About section in the right sidebar, choose Report repository, complete the contact form and submit. For a user, open the profile, choose Block or Report below the profile information, choose Report abuse, complete the form and submit. For issues, pull requests and comments, the same page says a report can sometimes go to repository admins instead.

That page does not describe gists, and it states no response times or review outcomes. It does point to a general abuse contact form, which is the nearest route we found for a gist, though the page does not say the form covers gists. Give the gist address and the author's username.

Filing a report that can be acted on

Capture the evidenceSave the exact URLs, dates and screenshots of each page, file, comment or gist.
Name the policyPick one policy from the table above and quote the part of it the content breaks. Keep copyright, privacy and defamation apart.
Point to the exact itemGive the file path, the line, the comment link or the gist URL. Say what personal data it contains and why it is private.
File through the right optionUse Report repository, Block or Report on the profile, or the general abuse contact form for gists, which the help page does not cover.
Keep the referenceNote the date, the form used and any reference number, and answer follow-ups with specifics.

Decide before filing whether to contact the owner first. GitHub's private information policy says contacting the user directly is appreciated but not required. With a stranger who is harassing you, a message can escalate and prompt them to move the content. With a former colleague who may simply delete it, a short factual message can be faster than a report.

When the private information removal policy applies and when it does not

GitHub describes its private information removal policy as an exceptional service only for high-risk content that violates its Terms of Service. The policy defines private information as content that should have stayed confidential and whose public availability creates a specific, targeted security risk. It covers access credentials such as passwords and tokens, documentation such as network diagrams that poses a specific security risk, and personal information that creates a security risk for an individual, such as government ID numbers.

The policy lists as not covered: files or repositories that are objectionable but pose no specific security risk, copyright matters, trademark matters, and privacy complaints, which go through GitHub's privacy contact form. A request needs working links to each file, line numbers, and an explanation of the security risk. Screenshots and search results are not accepted in place of links.

As the policy describes it, GitHub generally contacts the repository owner, who can remove or edit the information or dispute the claim. If the owner agrees to make changes but does not do so within the allowed window, GitHub disables the repository. If the owner disputes the claim, the dispute is generally resolved directly between you and the owner, and you must review the changes.

A repository that publishes an identity document number may fit. One that lists your name and employer with an unflattering description does not.

When a DMCA notice works and when it does not

A DMCA takedown notice is the one removal route with a formal legal structure, and it works only for copyright. GitHub's guide to submitting a DMCA takedown notice requires that you be the copyright owner or authorized to act on the owner's behalf. The notice must identify the copyrighted work, the infringing material (at minimum a URL), your contact details, a good-faith statement that the use is not authorized with fair use considered, and a sworn statement under penalty of perjury. The DMCA is a United States statute, so this route is built around US copyright law.

The guide also states what copyright does not protect: facts, including data, are generally not protected, words and short phrases generally are not, and neither are URLs and domain names. That rules out most complaints about being named: a repository that states facts about you, even incorrect ones, does not infringe your copyright by stating them. One that reproduces your own photo, article or source code can.

Three practical points from GitHub's DMCA takedown policy:

GitHub gives the repository owner approximately one business day to delete or modify the specified content. If the notice targets an entire repository, GitHub skips that window and disables it.
After a counter notice, the copyright owner must give GitHub notice of a court action within 10 to 14 days or the content is re-enabled.
GitHub publishes redacted notices, counter notices and retractions in its public github/dmca repository. It removes personal information except usernames in URLs, and does not redact other information unless you ask.

Forks, gists and cached views keep content alive after removal

Forks. For DMCA and private information requests, GitHub does not automatically disable forks of a disabled repository. Forks belong to separate users, and each fork must be named in the request. If every existing fork is identified when the claim is filed, a valid claim applies to the network at processing time, and for networks above 100 repositories GitHub may disable the whole network, but the notice must include a statement about the forks you reviewed.

Gists. Every gist is a Git repository, so it can be forked and cloned. GitHub's documentation says public gists are searchable and secret gists are not private: anyone with the URL can view one.

Cached views and history. GitHub's page on removing sensitive data says a force push alone does not clear cached views, which can be reached by commit hash, or pull requests that reference the commits. It states that GitHub Support can remove these on request, generally only when rotating a credential cannot mitigate the risk, and that Support will not remove non-sensitive data. If the repository is yours, deleting the file is not enough: the history must be rewritten, and forks and clones stay outside your reach.

Privacy and data protection requests to GitHub

Separate from content reports, GitHub's General Privacy Statement describes rights over personal data that GitHub holds. Its "Your Privacy Rights" section lists, depending on where you live, access, rectification, erasure or restriction under specific conditions, objection and portability. A separate US state section lists a right to request details of the information collected and to correct it, and a right to request deletion, with two free requests in any 12-month period and a response within 45 days, extendable by 45 days in complex cases.

Two limits matter here. First, those rights concern personal data GitHub processes about you, such as your account. The statement notes that other users may share information about you in issues and comments, but the sections read do not say how its rights apply to people mentioned in content others post. Whether a privacy request can reach a repository written by someone else is not settled by the sources read; the private information policy says only that privacy complaints go through a separate privacy contact form.

Second, in EU law, GDPR Article 17 gives a right to erasure on stated grounds, including that the data is no longer needed, that consent is withdrawn, that an objection succeeds, or that processing was unlawful. Article 17(3) lists exceptions, including exercising freedom of expression and information, and establishing, exercising or defending legal claims. Commentary about a person can engage those exceptions, so a privacy request is not a reliable tool for opinion or an accurate record.

A realistic timeline from report to search results

GitHub's abuse reporting page states no response times, and its private information policy says only that high volume can cause delays. The ranges below are therefore our experience of how such files usually move, not GitHub commitments. They also assume a report that names a clear policy breach and points to exact items.

Stage	Usual range	What drives it	Source of the range
Evidence capture and choice of route	Same day to 2 days	How many pages, forks and gists exist	Our experience
Report filed, first reply or action	Days, sometimes longer	Volume and clarity of the report	Our experience
Owner response window	About 1 business day under the DMCA policy	Policy type	GitHub DMCA takedown policy
Forks and cached views dealt with	One to several weeks	Number of forks, support requests	Our experience
Search result refreshed or removed	Days to several weeks after the page is gone	Search engine review	Our experience

Plan for weeks, not days, when forks exist.

Getting the search result to disappear after GitHub acts

Two Google tools matter here, and neither changes what GitHub hosts.

The page is gone. Google's Refresh Outdated Content tool is for content deleted from a site that still appears in Search because the description or cached copy is out of date. You enter the page URL and submit it. Google's page says that if you have already updated a live page, you do not have to fill out the form. Confirm the address no longer shows the content before you submit.

The page is still live but exposes personal information. Google's personal information policy lists what it can remove, including addresses, phone numbers, email, government ID numbers, bank and card numbers, and confidential usernames and passwords. It can remove doxxing content in two situations: personal information alongside explicit or implicit threats, or a significant amount of aggregated personal information without a legitimate purpose. You submit the specific URLs, and only those are reviewed. A removal can be full or partial: with a partial one the page may stop appearing for searches on your name but still appear for others. Google says it can only remove results from Search and may keep content about important or newsworthy matters.

Other search engines have their own forms. Results that remain can be pushed down lawfully with accurate, better content, which our suppression service covers.

The next step is to choose one route and file once

Pick the single policy the content breaks, file one request per item type with exact links, then search for distinctive text from the page to find forks and gists and report each separately. When GitHub confirms removal, submit any GitHub URLs that still appear for your name to the search engine.

If this is happening to you now

If a repository or gist publishes your address, threatens you, or impersonates you, capture it today and file under the matching policy before anything else. If you are not sure which route fits, or the content has spread to forks, Reputation Partners can review the file in a private audit and tell you what is removable and what is not.

Questions people ask

Can I get GitHub to delete a repository that only mentions my name?

Usually not. GitHub acts on policy violations such as private information, harassment, impersonation and copyright. A repository that names you in a neutral or even unflattering way, without private data or targeted abuse, does not meet those tests. The usual exception is a repository that is really a vehicle for something else on the list, such as a README that publishes your phone number.

Are secret gists private, and can I report one?

No. GitHub's documentation says secret gists are not private and that anyone with the URL can view one. The help page for reporting abuse does not describe gists, so the general abuse contact form is the nearest route we found: give it the gist URL and the author's username, and check the live form for the options it offers.

Does deleting a repository delete its forks?

For a public repository, no. GitHub's deletion page says deleting a public repository does not delete its forks. Deleting a private repository deletes all of its forks. Either way, clones on other people's machines are not affected, which is why forks must be named in a DMCA or private information request.

How long does it take for the search result to disappear?

GitHub states no response times for abuse reports, and Google's refresh page states no timeframe. In our experience the search step usually takes days to several weeks after the GitHub page is gone, depending on the request, the search engine and whether it asks for more detail.