But that's an easy fix. If they delete the repo, delete the stars. If they make it private, indicate it is now private in some way.
That's information disclosure; nothing about the repo after it's privated should be known, including name changes and deletion.
Itβs unclear to me what the attack vector is for that disclosure.
It was known and there are many sites scraping GH for metadata that will have it anyway
Not whether or not a repo exists after it's set private.
If an admin were to private->delete, then all the stars referencing the report would stay and thus the reference to the repo would still be there, on GitHub's servers. There's a difference between GitHub storing things forever and third parties on the internet being a forever archive of visible pages.