Commits by no collaborator into a GitHub private repo

Question

I've got a private repo in GitHub with two collaborators, but since yesterday, I'm seeing commits for a third person that is not a collaborator, nor has any kind of access to the repo. How is that possible?

Answer 1

There are two likely alternatives:

1. A collaborator may have committed using a different email address, perhaps by working on another machine. This could cause commits to show up as coming from another GitHub user (in the case where the new email address belongs to another user), or from a user who doesn't have a GitHub account (in the case where nobody has claimed the email address).

   In the second case, having the collaborator simply add the new email address to their GitHub account will cause the commits to be attributed to the collaborator.

2. Commits can be authored, committed, and pushed by different users. Non-collaborators can't push into your repository, but they can definitely provide commits for a collaborator to push.