Guides
Repository allowlist
Configure repository visibility without guessing what is safe.
Configuration
Set PUBLIC_REPOSITORY_ALLOWLIST on the server as a comma-separated list of normalized owner/name values.
PUBLIC_REPOSITORY_ALLOWLIST=owner/name,another-owner/another-nameBehavior
| State | Public result |
|---|---|
| Allowlisted | Repository metadata and supported related records may be returned. |
| Not allowlisted | Repository-derived records are omitted or return NOT_FOUND. |
| Empty variable | Repository pages may be policy-empty while status/feed sources remain public. |
Verify before publishing
- Confirm the repository is genuinely public.
- Confirm the canonical owner/name spelling.
- Add it to the production environment only.
- Check /api/v1/repositories and the hub route after deployment.