Dodo Payments' private repository was deleted as a result of Stainless' upstream repository deletion and has now been restored

Article

GitHub A bizarre repository deletion incident: a company acquired by Anthropic cleaned up code, causing customers' code to 2 disappear within seconds; they initially thought it was a hacker intrusion

Beating AI Breaking News, this year May, Anthropic acquired SDK API generation tools company Stainless. The latter then announced it would gradually shut down its original hosting service.October 27, a Stainless employee deleted one of its own GitHub private repositories, unexpectedly causing customer code to disappear as well.

The affected party was payment platform Dodo Payments. It had previously forked code from a Stainless private repository Fork(copied), and its entire SDK generation workflow relied on that repository. After Stainless deleted the original repository, in less than 2 seconds, Dodo's private repository was automatically deleted as well, without prior notice.

It turned out GitHub had a rule: when a private repository is deleted, all of its private Fork are deleted along with it. Even more absurdly, Dodo's audit log showed only that an external person had executed `repo.destroy`, without indicating that this was a cascading operation triggered by an upstream repository deletion. Co-founder Ayush Agarwal could not find any authorization record for the other party, and the repository was not on the recoverable list, so they briefly believed the company had been hacked.GitHub customer support subsequently helped the team determine the cause. Fortunately, Dodo retained a local copy of the code and ultimately re-uploaded it as an independent repository;SDK has resumed operations.

Agarwal hopes GitHub will explicitly identify upstream repository deletion as the reason in audit logs. He also reminded other Stainless customers to promptly convert private Fork still dependent on upstream repositories into independent repositories.

Original link https://m.theblockbeats.info/flash/374138

Key points

This year May, Anthropic acquired SDK API generation tools company Stainless.
October 27, a Stainless employee deleted a GitHub private repository.
Dodo Payments previously forked code from a Stainless private repository Fork.
After Stainless deleted the original repository, in less than 2 seconds, Dodo Payments' private repository was automatically deleted as well, without prior notice.
GitHub There was a rule: when a private repository is deleted, all of its private Fork are deleted along with it.
Dodo Payments' audit log showed that an external person executed repo.destroy.
Dodo Payments retained a local copy of the code and subsequently re-uploaded it as an independent repository;SDK has resumed operations.
Ayush Agarwal hopes GitHub will explicitly identify upstream repository deletion as the reason in audit logs, and reminds Stainless customers still dependent on upstream repositories to migrate private Fork。

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

A private repository's Fork is not necessarily independent. After an upstream repository is deleted,GitHub will also delete its private Fork; Dodo Payments restored its code because it retained a local copy.

Why it matters to readers

Teams dependent on private Fork may experience temporary code disappearance, service interruptions, and troubleshooting difficulties; they therefore need to confirm whether repositories are independent and retain backups.

Fork It can be understood as copying a codebase, but a private Fork may still be affected by the deletion rules of the original repository.

Risks and unknowns

The evidence comes from a report and does not provide GitHub or independent public announcements from the relevant companies for cross-verification.
The evidence does not state whether GitHub has modified its deletion rules, added warnings, or improved audit logs.
The evidence does not state whether other Stainless customers experienced similar incidents.

Dodo Payments' private repository was deleted as a result of Stainless' upstream repository deletion and has now been restored

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center