ST-2026-031 · Enforcement & amendments
GitHub adds privacy-safe aggregate star history after restricting stargazer identities
GitHub's phased privacy restrictions continue to limit identity-level stargazer and watcher access, while a new REST endpoint now provides historical aggregate star counts with timestamps without exposing individual stargazer data.
Previous state
Public callers and viewers could enumerate repository stargazers, watchers and a user's watched repositories through the listed APIs and UI views, and tools commonly derived star-growth history from identity-level listings.
Current state
Stargazer and watcher identity lists can return 403 unless the caller is an admin or collaborator, and the user subscriptions endpoint can return empty responses during deprecation; GitHub now also provides a privacy-safe star-history endpoint that returns historical aggregate star counts with timestamps without stargazer identities.
Affected users
Who needs to care
Analytics, community, research and automation tools that enumerate repository stargazers, watchers or user subscriptions, especially tools that previously derived repository star-growth history from identity-level listings.
Required response
What to do
Handle empty and 403 responses explicitly, remove assumptions of public identity enumerability, migrate star-growth analytics to GitHub's privacy-safe aggregate history endpoint where appropriate, and continue monitoring for the final subscriptions-endpoint removal date.
Evidence boundary
What the source does not prove
The 4 September endpoint provides historical aggregate star counts and timestamps without individual stargazer data. It does not restore identity-level access, reverse the earlier watcher or subscriptions restrictions, or provide the unstated final removal date for /users/{username}/subscriptions.
Lifecycle history
Dated event sequence
- Phased restrictions announced
GitHub described admin/collaborator restrictions and deprecation behaviour for identity-level stargazer, watcher and user-subscription access.
- Empty and forbidden responses begin
Affected callers may receive empty results or 403 responses as the privacy safeguards roll out.
- Privacy-safe star history released
GitHub introduced an aggregate star-history endpoint with counts and timestamps but no individual stargazer identities.
- Subscriptions endpoint removal
GitHub states that full removal will occur in a later phase without providing a date.
Evidence ledger
First-party sources
- 01GitHub Changelog — Upcoming access restrictions to public API endpoints and UI views
Official phased-access and deprecation notice · 2026-06-30
Open official source ↗ - 02GitHub Changelog — New API endpoint provides privacy-safe star history data
Official aggregate star-history release notice · 2026-09-04
Open official source ↗