GitHub Gist is our service for sharing snippets of code or other text content. Gist is built on Ruby on Rails and leverages a number of Open Source technologies.
If you share the URL of a secret gist, anyone with access to the URL will be able to see it without authentication. This is an intentional feature. Secret gists aren’t private. If you send the URL of a secret gist to a friend, they’ll be able to see it. However, if someone you don’t know discovers the URL, they’ll also be able to see your gist. If you need to keep your code away from prying eyes, you may want to create a private repository instead.
Raw gist files and user uploaded images are served from githubusercontent.com rather than gh.asamalin.top precisely so that active content cannot reach your GitHub session. Scripting that executes on that domain, including in an SVG, has no access to gh.asamalin.top cookies. See the githubusercontent.com page for what is and is not eligible there.
A gist can contain any text, including links to sites the author controls. Reports that a link in a gist leads somewhere hostile, or that a URL shortener obscures its destination, are ineligible. The same applies to the interstitial we show when leaving GitHub: it is a warning, not a security boundary.
Gist history is kept in Git, so a revision that was once public may remain reachable through the Git interface or through a fork after the gist is edited or deleted. Treat anything published in a gist as published. If you committed a secret to a gist, rotate it.