In anonymized view-only link, GitHub information is not anonymized

[umhan35]

What you did (step by step)

1. Connect GitHub to a project
2. Create a view-only link to share the OSF project (check off "Anonymize contributor list for this link (e.g., for blind peer review)")
3. Go to the view-only link

Where does this happen on the OSF?

Anonymized view-only homepage of a project, e.g., https://osf.io/ga9w8/?view_only=3ec356c101944ec092c6badfbb0fb593

What you expected

The open button should not appear for people to go to the GitHub link

What actually happened

One can click the open button and find out information about the contributors of the OSF repo

Potential causes

Related code that may have caused this:

osf.io/addons/github/static/githubFangornConfig.js

Lines 283 to 291 in 3920a29

	if (item.data.permissions && item.data.permissions.view && !item.data.permissions.private) {
	buttons.push(
	m('a.text-info.fangorn-toolbar-icon', {href: item.data.extra.webView}, [
	m('i.fa.fa-external-link'),
	m('span', 'View on GitHub')
	])
	);
	}
	}

Suggest a solution

Similar to the hidden GitHub repo (username/repo-name) in a view-only link, as seen below, the Open button should also be hidden.

Not view-only	View-only

Final words

I think the branch list should also be hidden in a view-only link

[follhim]

This appears to be a significant issue with using GitHub for OSF. I'm adding a comment here to highlight this concern.

@umhan35, it seems that the issue with accessing your OSF view-only repository has been resolved. Was this fixed, or is it working correctly for you now?

[umhan35]

@follhim I just reproduced this issue with the view-only link in the description, so it is not fixed.

[follhim]

@umhan35 I see, and to be specific, it's not that the link can be opened (I cannot open the repository on github), but even when it says Not found error 404, it shows essentially the repository by looking at the website address:

https://github.com/umhan35/weka-dt/tree/main

when ideally, the link shouldn't be accessible at all. Right?

[umhan35]

when ideally, the link shouldn't be accessible at all. Right?

Right. Because the GitHub username/profile reveals the identity of the OSF contributors.

(BTW, I think the branch list should also be hidden in a view-only link)