Privacy: hide membership within a team, or as a collaborator

[pawamoy]

Select Topic Area

Product Feedback

Body

To give access to multiple repositories at once for my sponsors, I created an organization, and inside the organization a team. This team serves as a bridge between sponsors and sponsors-only projects:

flowchart TB
user["user"]
team["insiders (team)"]

subgraph github ["GitHub"]
  user -->|added to| team
  subgraph org ["@pawamoy-insiders"]
    team -->|gives access to| repo1
    team -->|gives access to| repo2
    repo3 --- repo3
  end
end

linkStyle 3 display:none;

Loading

There's a privacy issue though: users added to the team can see all the other team members. This goes against the option to sponsor someone privately. Anyone could sponsor for a short amount of time to check if a specific user is also a sponsor.

The same goes for the simpler workflow where sponsors are added as collaborators to a private repository: while there is no dedicated page in GitHub's web interface to see current collaborators (like the members listing page for teams), it is still possible to fetch the list of collaborators through the API:

gh api \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  /repos/user/private-project/collaborators

(as long as you are yourself a collaborator of course)

With all this in mind, I would like to request a new membership visibility option: secret.
Just like teams can be public, private or secret, I would like members of a team (or collaborators of a project) to be able to configure the visibility of their membership as public, private or secret. Public and private keep working as they do now:

• public: the world can see your membership
• private: only other members can see your membership

...and secret would fix the privacy issue:

• secret: nobody can see your membership, except the team/org admins