diff --git a/2026/07/2026-07-20-source-code.md b/2026/07/2026-07-20-source-code.md new file mode 100644 index 0000000000..d4eb707a15 --- /dev/null +++ b/2026/07/2026-07-20-source-code.md @@ -0,0 +1,97 @@ +Before disabling any content in relation to this takedown notice, GitHub +- contacted the owners of some or all of the affected repositories to give them an opportunity to [make changes](https://docs.github.com/en/github/site-policy/dmca-takedown-policy#a-how-does-this-actually-work). +- provided information on how to [submit a DMCA Counter Notice](https://docs.github.com/en/articles/guide-to-submitting-a-dmca-counter-notice). + +To learn about when and why GitHub may process some notices this way, please visit our [README](https://github.com/github/dmca/blob/master/README.md#anatomy-of-a-takedown-notice). + +--- + +While GitHub did not find sufficient information to determine a valid anti-circumvention claim, we determined that this takedown notice contains other valid copyright claim(s). + +--- + +**Are you the copyright holder or authorized to act on the copyright owner's behalf? If you are submitting this notice on behalf of a company, please be sure to use an email address on the company's domain. If you use a personal email address for a notice submitted on behalf of a company, we may not be able to process it.** + +Yes, I am authorized to act on the copyright owner's behalf. + +**Are you submitting a revised DMCA notice after GitHub Trust & Safety requested you make changes to your original notice?** + +No + +**Does your claim involve content on GitHub or npm.js?** + +GitHub + +**Please describe the nature of your copyright ownership or authorization to act on the owner's behalf.** + +I am submitting this notice on behalf of the copyright owner. The copyrighted source code belongs to our company and was developed as proprietary software for our internal business operations and commercial services. I am authorized to act on behalf of the copyright owner in this matter. + +**Please provide a detailed description of the original copyrighted work that has allegedly been infringed.** + +The copyrighted work is our company's private proprietary software used in production. It includes the complete backend source code, business logic, APIs, integrations with third-party services, authentication mechanisms, administration tools, internal libraries, configuration, and supporting components. + +The software has never been released as open source and has always been maintained as confidential proprietary software. + +The repository published on GitHub is an unauthorized copy created from source code obtained during a recent compromise of our production infrastructure. + +**If the original work referenced above is available online, please provide a URL.** + +The original copyrighted work is not publicly available + +**We ask that a DMCA takedown notice list every specific file in the repository that is infringing, unless the entire contents of the repository are infringing on your copyright. Please clearly state that the entire repository is infringing, OR provide the specific files within the repository you would like removed.** + +**Based on the above, I confirm that:** + +The entire repository is infringing + +**Identify the full repository URL that is infringing:** + +[private] + +**Do you claim to have any technological measures in place to control access to your copyrighted content? Please see our Complaints about Anti-Circumvention Technology if you are unsure.** + +Yes + +**What technological measures do you have in place and how do they effectively control access to your copyrighted material?** + +Our source code was stored exclusively on private production servers and was not publicly accessible. + +Access to the source code was restricted using SSH authentication, private Git repositories, server access controls, operating system permissions, and network access restrictions. The source code was available only to authorized personnel with valid credentials. + +Following the security incident, all compromised SSH credentials have been revoked, all SSH keys have been rotated, unauthorized access has been removed, Git access has been secured, and unnecessary ports and remote access have been disabled to prevent any further unauthorized access. + +**How is the accused project designed to circumvent your technological protection measures?** + +The repository contains source code obtained by bypassing our access controls through unauthorized access to our private production infrastructure. The unauthorized access was achieved using compromised SSH credentials, allowing the attacker to copy our private source code and publish it on GitHub without authorization. + +The repository itself is a direct copy of material that was protected by our access control mechanisms and was never intended for public distribution. + +**If you are reporting an allegedly infringing fork, please note that each fork is a distinct repository and must be identified separately. Please read more about forks. As forks may often contain different material than in the parent repository, if you believe any of the repositories or files in the forks are infringing, please list each fork URL below:** + +**Is the work licensed under an open source license?** + +No + +**What would be the best solution for the alleged infringement?** + +Reported content must be removed + +**Do you have the alleged infringer’s contact information? If so, please provide it.** + +We don't have the infringer's contact information. + +**I have a good faith belief that use of the copyrighted materials described above on the infringing web pages is not authorized by the copyright owner, or its agent, or the law.** + +**I have taken fair use into consideration.** + +**I swear, under penalty of perjury, that the information in this notification is accurate and that I am the copyright owner, or am authorized to act on behalf of the owner, of an exclusive right that is allegedly infringed.** + +**I have read and understand GitHub's Guide to Submitting a DMCA Takedown Notice.** + +**So that we can get back to you, please provide either your telephone number or physical address.** + +[private] + +**Please type your full name for your signature.** + +[private]