How access to your files works

Identity and authorization

GitHub sign-in supplies your account identity. It does not give LFSPush permission to read your GitHub repositories, and GitHub collaborator permissions do not automatically grant LFSPush access. Organization roles and repository-scoped tokens govern access separately.

Use read-only tokens for consumers and write tokens only where uploads or lock changes are required. Removing a member revokes their personal tokens; organization service tokens are managed independently.

Private transfers

The object bucket is private. Authenticated protocol requests mint temporary signed upload or download actions. Downloads require authorization; there is no public or anonymous download mode.

Treat a signed URL as a temporary credential. Anyone holding it may use it until it expires, even after the originating token is revoked. Upload links last at most one hour; download links last 15 minutes. Uploads are size-checked and verified against their SHA-256 object identifier before becoming ready.

Incident response

If a token may be exposed, revoke it and replace the credentials in affected machines or jobs. Give support the workspace/repository ID, the approximate time, and a request ID if available. Do not include tokens or signed URLs.

Operators can suspend writes or use emergency access suspension. These controls stop new authorized requests but do not immediately revoke previously issued signed URLs. Billing restrictions are separate and preserve existing downloads.

Responsible reporting

Report a suspected security issue through a private support ticket after signing in. Describe the impact and reproduction steps without including another customer's files or credentials.