Who says only you can access your private repository on GitHub?

A private repository means only approved users can see it, let alone access it (read/write). Since I only gave the permissions to myself (the default), nobody can access it.

@ratouney Nobody except Github staff. Although they are bound to certain restrictions in their privacy policy, chapter "How GitHub secures your information". By the way, did you know that Git is actually a tool you can use locally without the help of a website? And that there is Gitlab, which is basically a clone of Github anyone can install on an internal webserver for use within their organization?

Your opinion about how accessible or secure the repository is, is irrelevant. You placed the information on a third-party website without permission of the management: end of. Even for general commercial data, that's bad, but for sensitive banking information, it's the FU you say, and it's good that you learned this lesson before something really disasterous happened.

ratouney, no, a private repository means they convinced you that only approved users can see it. In reality is is or may be accessible to GitHub stuff, police with a search warrant, hackers without a search warrant, and so on. Huge difference. That's three groups who laugh at your "nobody can access it".

To bang on a bit more, such subjective decisions are not yours to make, as the contract clearly says. Otherwise working practices come down to personal opinion, not policy.

out of curiosity only, how did management detect that? I'm just wondering if they have an automated scanner tool.

@user253751 perhaps they have a management tool that monitors the activity of OP's work station. Company computers are frequently networked: not with individual connections to the outside world.

@WeatherVane and it would be unusual to have Github on a monitoring list

@user253751 as an upload destination? Surely that's a red flag.

Something that I haven't seen mentioned: your employer presumably owns the code (work product) that you're writing. They don't know if you're using GitHub as a tool for your work, or to archive it so it's available if you quit or get fired. It sounds like they're taking your word for it and giving you the benefit of the doubt, but I'm not surprised they're unwilling to let you keep a repository on a system they don't own and control.

You might get some helpful info on this by posting a related question on the InfoSec stack. Another thing that strikes me is that if your company is really serious about information security then they should be requiring all employees go through cybersecurity awareness training before being allowed access to anything sensitive. Since you are a coder, that goes double. Also it would serve your career very well to learn all that you can about cyber security and to take a security first approach in your coding and be very careful how you handle all code and data.

In addition to the other answers - do you know what your contact with GitHub is? Do you know if they can access your data and make use of them for [whatever]?

@ToddWilcox: I am not sure I understand what OP would gain from posting at SE InfoSec? There was no breach, vulnerabilities, ...

@WoJ They don’t seem to understand what is wrong with uploading code they’ve written for their employer to a private GitHub repo. I’m suggesting a possible question like “what is the risk in putting sensitive code in a private GitHub repo?” Such a question might help the asker understand both what they did wrong here and what not to do in the future. Especially since it seems they have not been required to take appropriate CSAT training.

@ToddWilcox: there is no infosec risk. There is a compliance/IP risk, yes. From the perspective of information security, Github is fine (= it is a SaaS that does not have any serious known vulnerabilities). I agree with the training part (which is not an infosec training per se - it is the same as sharing confidential information via other means than web) but if you ask an infosec professional they will respond that it is fine - it i snot up to them to decide whether a site is legally sound to share data)

@WoJ I won’t get into a completely off topic debate here. I will say I have reason to believe not everyone agrees that there is no vulnerability in a GitHub private repo.

@ToddWilcox: not everyone agrees that there is no vulnerability in a GitHub private repo → this would be very good information, especially for companies that use this feature extensively. Please share, the infosec community will be very gateful.

Why would you upload it to GitHub instead of just keeping it in a local Git repository on your machine? Are you perhaps using GitHub to sync the repo between multiple machines? I otherwise find it hard to justify uploading confidential code to an external website whose sole purpose is sharing code, and I suspect your management thinks along the same lines.