> For the first two, git is based on content addressable storage, so it makes sense that anything that is every public will never disappear.

this isn't quite right

content addressable storage is just a mean of access it does

- not imply content cannot be deleted

- not imply content cannot be access managed

you could apply this to a git repo itself (like making some branches private and some not) but more important forks are not git ops, they are more high level github ops and could very well have appropriate measurements to make sure this cannot happen

e.g. if github had implemented forks like a `git clone` _non of this vulnerabilities would have been a thing_

similar implemented different access rights for different subsets of fork networks (or even the same git repo) technically isn't a problem either (not trivial but quite doable)

and I mean commits made to private repositories being public is always a security vulnerability no matter how much github claims it's intended