Exploring User Privacy Awareness on GitHub: An Empirical Study

TL;DR

This empirical study investigates how GitHub users utilize privacy settings, revealing disclosures of sensitive information and exploring the potential of language models to develop personalized privacy protection tools.

Contribution

The paper provides the first comprehensive analysis of privacy setting usage on GitHub and proposes a methodology using language models for personalized privacy assistance.

Findings

Active user engagement with privacy settings

Disclosures of sensitive information in pull request comments

Potential for personalized privacy tools using language models

Abstract

GitHub provides developers with a practical way to distribute source code and collaboratively work on common projects. To enhance account security and privacy, GitHub allows its users to manage access permissions, review audit logs, and enable two-factor authentication. However, despite the endless effort, the platform still faces various issues related to the privacy of its users. This paper presents an empirical study delving into the GitHub ecosystem. Our focus is on investigating the utilization of privacy settings on the platform and identifying various types of sensitive information disclosed by users. Leveraging a dataset comprising 6,132 developers, we report and analyze their activities by means of comments on pull requests. Our findings indicate an active engagement by users with the available privacy settings on GitHub. Notably, we observe the disclosure of different forms of private information within pull request comments. This observation has prompted our exploration into sensitivity detection using a large language model and BERT, to pave the way for a personalized privacy assistant. Our work provides insights into the utilization of existing privacy protection tools, such as privacy settings, along with their inherent limitations. Essentially, we aim to advance research in this field by providing both the motivation for creating such privacy protection tools and a proposed methodology for personalizing them.