GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories

Summary

@mik317 submitted a misconfiguration in some of our GitHub repositories to us. Wikis are inherently editable for all users, but for some repositories an organization may want to restrict this access. In some cases it was possible for GitHub users outside of the Hacker0x01 organization to add and edit wiki pages of open source repositories of HackerOne. We decided to address this because some of these repositories are open source libraries that are used by people outside of HackerOne, like react-datepicker. To avoid confusion to those users, we're now restricting access to the wiki or completely removed the wiki.

We audited our public GitHub repositories and determined whether the access should be revoked. It has, on purpose, not been disabled for all repositories.

In order to revoke access, go into the Settings of a GitHub repository. On the right will be a "Features" section. The top two items are "Wikis" and "Restrict editing to users in teams with push access only". The options are pretty self-explanatory. In case the repository doesn't need a wiki, it'd be recommended to disable the wiki all-together. In case you do need it, check the second option to ensure only team members can contribute to the wiki.

We'd like to thank @mik317 for bringing this to our attention!