On 30 June, at nine minutes past three in the afternoon, a machine at GitHub decided I was a machine. It locked my account. My repositories, my profile, my Pages, all of it went 404 to the world. Not deleted. I could still see everything from the inside. Just switched off, so that to everyone else I had simply never existed. No email. No warning. No reason. And I was asleep when it happened.
What it saw
I pulled my own security log before I got angry, because I wanted to be fair. I will not pretend the machine hallucinated. My tools had been busy: more than a thousand OAuth tokens minted and rotated, hundreds of repositories created and destroyed by automation running in my name. To an abuse detector, that is not a person. That is a bot.
Here is the part that still stings. I have never used GitHub Copilot. Not once. Yet two Copilot apps churned 963 of those tokens on their own, from January to June, an integration I never turned on, working under my name while I was somewhere else living my life. I did not use the feature. The feature used me. And then it got me flagged.
A door with no one behind it
To appeal, GitHub sends you to a screen that asks you to prove you are human. A captcha. It never loaded for me.
That is the whole thing in one picture. A red error saying it cannot verify me, and a green checkmark underneath saying I am verified. Both at once. No text ever arrived. No ticket ever opened. No person ever answered, because there is no person. It is machines all the way down.
I am not special. Michal Flaška lost around a thousand repositories exactly this way, pulled his logs like I pulled mine, and found the same culprit: “the bad actor didn’t delete anything. GitHub’s own automation did.” He waited forty days. Another developer gave up by day ten and left for Codeberg, where I am now. There are dozens of us saying the same three sentences. Same 404. Same silence. Same machine.
What I actually signed up for
I subscribed to a tool. Machines I would orchestrate, machines I would give orders to. Build this. Run that. Host my work. I never signed up to be judged by machines I do not command, machines that flag me, lock me, and shut a door in my face while no human watches. The only machines I ever agreed to work with are the ones that take my orders, never the ones that give them to me.
A multi-trillion-dollar company decided humans do not scale, and quietly removed them. What is left flagged me, gated me, ignored me, and a marketing page calls it support.
So keep it
GitHub, you do not have to restore my account. Please, don’t bother.
I care about code more than almost anything I make, and I cannot keep what I love in a place where no one like me is home. Thinking about you now makes me nauseous, and I do not need that in my life.
I took my work, and I left. I am not coming back.
And I did not just leave. I became a member of Codeberg e.V., the non-profit behind the place I moved to, where humans vote on its direction. A machine decided I did not belong at GitHub. At Codeberg, I have a vote.
Addendum, three hours later
I published this post, shared it in four places, and went about my morning. Three hours later, out of curiosity, I clicked the support link one more time.
The wall was gone.
No SMS screen. No captcha refusing to verify me. The support portal simply loaded and offered me two situations to choose from.
It walked me to a form titled “Reinstatement request.” One of its radio buttons reads, word for word: “I can login, but my profile and contributions aren’t visible to others.” My whole catastrophe, pre-printed as a checkbox. I was never an edge case. I was a category common enough to have its own form field.
The billing page, meanwhile, now tells me three things at once. A banner at the top asks me to please update my payment method. A toast announces my billing information was successfully updated. And a warning box below them both says I cannot update my billing information, because my account is flagged and ineligible for transactions. The machine orders the repair, reports the repair, and forbids the repair, in one screen.
I wrote in this post that the appeal only works when you are loud in public, and I hoped to be wrong about that. The door that stayed shut while I knocked for two days moved by itself the same morning people were reading about it. Draw your own conclusion about who it moves for.
I am a solo developer in Zagreb with a blog about running Swift everywhere, making Swift do anything, rebuilding Apple frameworks nobody asked me to rebuild. My megaphone is a paper cup. If the sound carried, it is because strangers passed it from hand to hand until someone with a real megaphone heard it.
To be clear about the score: I am still blocked. The noise did not open the door. It opened the waiting room. For everyone locked out this way without an audience, even the waiting room stays shut.
The form is there now. I did not ask them to open it.
Will I fill it in? I still do not know. There is exactly one reason to: if my account is ever deleted for good, my username becomes available, and whoever claims it inherits every old link to Cupertino. A stranger could stand at my old address, wearing my name, serving their code to people who trusted mine. So I may apply after all, not to return, but to hold the ground: one repository, Cupertino, kept as nothing but a redirect pointing home.
Everything else can go. My packages will drop off the Swift Package Index, which only indexes packages hosted on GitHub, and I have made my peace with that. None of them were essential to the community, so nothing of value is lost. I find no joy in seeing them tied to a place I left. They are already on Codeberg, whole. A listing is not a home.
Everything I make lives where a human answers the door.
Addendum, one day later
There is one more place where GitHub is required to tell the truth about what it did to me, and I went and looked.
Under the EU’s Digital Services Act, a platform that restricts you must hand you a statement of reasons, and must file that statement in the European Commission’s public DSA Transparency Database. Article 17 names the cases one by one: restricting the visibility of your content, suspending monetary payments, suspending the service, suspending your account. What happened to me on 30 June was all four at once. I never received a statement. So I checked whether they ever wrote one.
The database publishes complete daily dumps. I downloaded the three days around my lock and read every row, 66.7 million statements from every platform operating in Europe. My totals matched the Commission’s published counts exactly, so I know I missed nothing.
On 30 June, the day my account was locked at 15:09, GitHub filed nothing. Not about me, about anyone. On 1 July it filed 20,570 statements in a single batch, every one of them an account suspension for actions taken on 29 June, almost all for scams and fraud. On 2 July, nothing again. No statement covering any GitHub decision from 30 June exists in the database.
Then I stopped filtering by date and asked a wider question. In the entire history of the database, across everything GitHub has ever filed, the number of statements reporting a monetary restriction is zero. The number reporting a suspension of service is zero. GitHub Sponsors suspends payouts with every lock like mine, the law names that as a reportable restriction, and the count of times GitHub has reported one is zero. This is not a late batch. This is a category of decision that their reporting pipeline was never taught to mention.
Maybe a batch for 30 June still shows up in some later dump. It changes nothing. Article 17 is explicit about the moment: the statement of reasons is owed at the latest from the date the restriction is imposed, and it is owed to the person restricted. Not to a database, eventually. To me, then. On 30 June they took my visibility, my funding, my service, and my account in one stroke, and they told me nothing. Not that day, not since.
The violation was complete at 15:09 on 30 June, the moment they acted without informing me. Nothing GitHub files later can reach back and undo that.
One more field, and I will leave it with you. Every statement GitHub files carries a flag saying whether the decision was automated. All 20,570 say the same thing: not automated. Twenty thousand human decisions in one day, they tell the regulator???? I titled this post before I read their filings. To the Commission, GitHub reports a building full of humans. At the door where I knocked for two days, there was no one. Both cannot be true.