Gotcha: GitHub Custom Properties are public

I was speaking to someone the other day - while I've been at Open Source Summit (Europe) - about the great Custom Properties that GitHub added in ~2023. However, they weren't aware that they're available to anyone with read access to the repo - which means for a public repo, that's everyone! This was something we found at Elastic while we were rolling out something that sounds pretty juicy called security_level. This was a mandatory field across all our repos, which was set to a reasonable default value. We ideally wanted to have our Custom Properties' descriptions include more context about what the security level fields meant, and a link to our internal docs for more in-depth information and how to change it. At Elastic we had a lot of Open Source (and public repos which are not-Open Source), which meant that anyone would be able to look up the descriptions of these fields. We can see this in action on i.e. github/gh-stack by using the API: [ { "property_name": "client-app",…