Unable to contact GitHub Support for sensitive data removal (GitHub Free)

[Max75020]

🏷️ Discussion Type

Question

Body

Hello,

I'm using GitHub Free and have completed the documented sensitive data removal procedure with git-filter-repo, including force-pushing the cleaned history.

However, some old commits remain accessible by SHA.

GitHub's documentation recommends contacting Support for server-side cleanup, but the new Help portal only redirects me to Copilot responses. I cannot find an option to create a support ticket.

Could a GitHub staff member explain how a GitHub Free user can submit this specific security-related request for human review?

I can provide the affected repositories and commit hashes privately to Support.

Thank you.

[g4lb]

GitHub Free can open a ticket for security issues. Copilot answers first. If it does not help, continue to the ticket form (docs).

[kaluarachchiteshan]

Hi,

I can't speak for GitHub staff, but here is what has worked for others and what to check while you wait.

1. Treat any exposed secret as compromised

Even after a successful rewrite, old commits can stay reachable by SHA, in forks, and in cached views. Revoke and rotate any credentials that were in them. That protects you now, whatever Support does later.

2. Why the old commits are still reachable

A force-push removes them from your branches, but GitHub can keep them through:

• refs/pull/* references from old pull requests
• forks and other repositories in the same network
• cached views and direct SHA URLs, which are only purged by GitHub

3. Ways to reach a person on a Free plan

• Go to https://support.github.com/contact and look for the sensitive data or private information request form. Free accounts are allowed to submit tickets, but the portal may route you to the AI assistant first. Look for a "Contact support" or "Still need help?" option after the suggested answers.
• Try the direct form for removing sensitive data: https://support.github.com/contact/private-information. This is the form I know of for this request, but I haven't confirmed it is still current.
• Make sure you are signed in. Some forms only show for signed-in accounts and only offer options that match your account type.
• Try a private browser window with extensions disabled, since blockers can hide the form.
• If GitHub's docs ("Removing sensitive data from a repository") link to a specific form, use that link.

4. What to put in the request

• Your username and the repository URL
• The commit SHAs that are still accessible (send these only through the support form, not in a public thread)
• That you ran git-filter-repo and force-pushed
• That you need a server-side purge of cached views and unreachable commits, and removal of pull request refs
• That you already rotated the exposed credentials

5. If you can't get a ticket through

If there are no forks and you only need a clean slate, deleting the repository and recreating it with the cleaned history removes the old objects once the deletion completes. Be careful: you lose issues, pull requests and stars. Also confirm first that nobody has forked it.

Please don't post commit hashes or secret details in this thread.