Review retained secrets and collaborators after a GitHub repository transfer

Changing the repository owner does not automatically rebuild its integration and access boundaries.

Source facts

GitHub documents that repository webhooks, services, secrets and deploy keys remain associated after a transfer. Existing collaborators generally remain, and the original owner is added as a collaborator, with documented exceptions for particular account transitions. Transferring to an organization also applies its default repository permissions and membership privileges. Feature availability can change with the destination account’s plan.

Source: GitHub — Transferring a repository.

Applicability

This concerns GitHub repository ownership transfer. Redirected Git URLs do not prove that deployment credentials, organization policy or a linked Pages site were reviewed successfully.

DSE recommendation

DSE recommends inventorying access, automation and publication dependencies before proposing a transfer. Ask the receiving owner to approve retained collaborators, keys, secrets and webhook destinations. Review the destination’s default permissions and required protection features. Treat the transfer as a change with acceptance checks and an owner for any integration repair rather than assuming a successful ownership change completes the migration. Give the receiving owner a before-and-after acceptance list covering access, credentials and automated destinations. Require a deliberate decision for every retained integration and record the new support owner before treating the transferred repository as ready for ordinary releases.

Verification

Proposed verification: in an approved transfer exercise, compare the before-and-after repository inventory and effective protections. Run a harmless CI and integration check through the intended destination. Inspect retained credentials by identifier only, verify approved collaborators and record any lost feature or redirected dependency that still needs remediation.

Official reference

GitHub — Transferring a repository. Reviewed October 20, 2026.