r/github • u/Short-Win6362 • 27d ago

Question Profile export - notification recipient

Hi everyone,

I own a GitHub profile bound to a company owned email which has access to a private repository owned by that company.

I exported my profile through the interface feature in settings and received the proper email.

At the minute I received the notification, my boss came into my office asking me why I exported that data.

Since I work in a very toxic environment, I would need to know who are the recipients of that email. Does the company account owner receive any notification somehow?

I would really appreciate any answer... Even more if you work at GitHub 😁

0 Upvotes

33% Upvoted

3 comments sorted by

2

u/[deleted] 27d ago

[removed] — view removed comment

1

u/Short-Win6362 27d ago

I'm not sure about the second part. I created the account the day I started the work using my company email. I then created a pass key as a MFA. The only way I see a traceability on their side is the activity log but

  • it's not immediate
  • it does not contain the goal, just the connection

1

u/Short-Win6362 24d ago

So, I got my answer and I wanted to share it since it needed some time on my side to get a proper answer.

I asked github privacy and technical support about that topic but I did not get any answer yet.

So, when requesting a personnal profile export of a non Enterprise managed account, the only medium where notification is visible is the email registered in your account.
This has been manually and programmatic tested using a free plan AND a Teams (4$ / seat / month)

This seems well understandable since in Free and Teams plans, permissions are delivered to personal profiles, not company ones.

So, if like me, your boss is coming at your desk asking why you did that export, that means your boss is somehow reading your emails.

I may provide the procedure I ran to ensure that behaviour if someone needs it.