A recruiter directly e-mailed me about a job offer and pretended to have found the e-mail address via my GitHub account. Normally I receive e-mails via LinkedIn and almost never directly, as I try my best to avoid exposing my personal e-mail.

While I doubt her claim I also know that when GDPR hit the world the few recruiters that somehow got my person e-mail address sent an e-mail asking to be allowed to further store it and use, most probably forced by GDPR since I never consented to the e-mail storage and usage anyway. So, this might explain why the recruiter felt to justify the direct e-mail.

This old article (2014) indicates that I should be able to see public data exposed by a GitHub account by accessing https://api.github.com/users/{account_name}/events/public. I receive an empty array for my account, but I expect that in 5 years GitHub's API to have changed a lot.

I check my account while not being logged in and I could only see the city as expected (the account is configured so).

I have logged into my account and searched for my e-mail and found it only once within a private repository (created private, never changed to public).

Is there something else I could do to make sure that my e-mail address is not exposed through GitHub activity?

  • This sounds more like a question for GitHub support than a security site.
    – schroeder
    Nov 17, 2019 at 17:25
  • Yes. You are right, but I am also interested in the community's perspective.
    – Alexei
    Nov 17, 2019 at 17:35
  • What's your github account? Let's have a look.
    – schroeder
    Nov 17, 2019 at 18:03
  • If you want to know how the API works, have you looked at the recent spec?
    – schroeder
    Nov 17, 2019 at 18:04
  • Alexei000 is the id
    – Alexei
    Nov 17, 2019 at 18:15


Browse other questions tagged .