When GitHub Went Dark: How OWASP BLT Found a New Home

Description and use

OWASP BLT lost access to 50+ GitHub repositories during an outage, halting development. The team migrated to GitLab, then consolidated all projects into a single repository on a self‑hosted ForkMesh forge, preserving history and contributors. GitHub now serves only as a read‑only mirror.

Problem

OWASP BLT lost access to 50+ GitHub repositories during a GitHub outage, halting development during Google Summer of Code.

Outcome

OWASP BLT successfully restored development by migrating to GitLab, then consolidating into a single ForkMesh repository, preserving all history and contributors, and establishing GitHub as a read‑only mirror.

Workflow

• Applied organization‑wide GitHub ruleset for security hygiene
• GitHub outage occurred and repositories went offline
• Contacted GitHub support with no clear explanation
• Migrated code to GitLab to resume development
• Consolidated all projects into one repository on ForkMesh
• Set up ForkMesh as source of truth and mirrored to GitHub
• Archived GitLab repositories and migrated open issues/merge requests
• Cleaned up technical debt (e.g., data jobs to Cloudflare storage)

Evidence

We woke up to find our GitHub repositories offline. All 50+ of them.

Source

We moved our repositories to GitLab. We pushed the code, redirected contributors to the new location, and worked on getting everything running again.

Source

We gave ForkMesh a try. And it stuck.

Source

Our official source of truth is now git.owaspblt.org/BLT, running on ForkMesh.

Source