Unusually high git clones 100k in one day

[bradar93]

🏷️ Discussion Type

Question

Body

We saw an unexpected spike of ~100k clone events on one of our repositories on May 11, 2026.

The repo normally has very low clone traffic, so this appears highly abnormal. GitHub Traffic analytics shows the spike, but the audit logs do not show corresponding repo.clone events. This is a private repo.

Has anyone else seen this happen before?

Would also be useful to know:

• how reliable GitHub clone metrics are at large volumes
• whether there is any way to attribute clone traffic further

Thanks.

[P-r-e-m-i-u-m]

A few things I would separate here: traffic analytics, audit logs, and Git transport events are not the same data product.

GitHub's repository traffic API gives aggregate clone counts and unique cloners, but it does not expose per-user/per-token attribution for clone traffic. It is useful for trend analysis, not forensic attribution.

For audit logs, git.clone exists for organization/enterprise audit logging, but GitHub's docs note that Git events have specific availability/search/export behavior depending on product and access path. Also, the event is documented as covering clone/fetch/pull style Git activity, so it may not line up 1:1 with the traffic graph in the way people expect.

What I would check:

1. Compare total clones vs unique cloners. If total is huge but uniques are low, it may be automation repeatedly cloning/fetching.
2. Check whether CI, dependency scanners, mirrors, backup jobs, or deployment systems started running around May 11.
3. Query the Traffic API while the data is still available and save the result, because traffic data is time-windowed.
4. If this is a private repo and the spike is unexplained, review access tokens, GitHub Apps, deploy keys, and org/repo collaborators around that date.
5. If you are on Enterprise/Org audit logging, check exported/API audit events for git.clone / Git access events rather than relying only on the web UI.

Docs:

• Repository traffic API: https://docs.github.com/rest/metrics/traffic
• Organization audit log review: https://docs.github.com/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization
• Audit log events, including Git events: https://docs.github.com/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization

So yes, a spike can be real without the Traffic page giving you enough detail to attribute it. For private repos, I would treat a 100k spike as worth checking automation and credentials, even if it turns out to be a benign internal process.