WingNews logo WingNews
top | item 47163885

Tell HN: YC companies scrape GitHub activity, send spam emails to users

675 points| miki123211 | 3 days ago

Hi HN,

I recently noticed that an YC company (Run ANywhere, W26) sent me the following email:

From: Aditya <aditya@buildrunanywhere.org>

Subject: Mikołaj, think you'd like this

[snip]

Hi Mikołaj,

I found your GitHub and thought you might like what we're building.

[snip]

I have also received a deluge of similar emails from another AI company, Voice.AI (doesn't seem to be YC affiliated). These emails indicate that those companies scrape people's Github activity, and if they notice users contributing to repos in their field of business, send marketing emails to those users without receiving their consent. My guess is that they use commit metadata for this purpose. This includes recipients under the GDPR (AKA me).

I've sent complaints to both organizations, no response so far.

I have just contacted both Github and YC Ethics on this issue, I'll update here if I get a response.

256 comments

order

martinwoodward|3 days ago

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board.

The fundamental nature of Git makes this pretty easy for folks to scrape data from open source repositories. It's against our terms of service and those folks might want to talk with some lawyers about doing it - but as every Git commit contains your name and email address in the commit data it's not technically difficult even if it is unethical.

From the early days we've added features to help users anonymise their email addresses for commits posted to GitHub. Basically, you configure your local Git client to use your 'no-reply' email address in commits and that still links back to your GitHub account when you push: https://docs.github.com/en/account-and-profile/reference/ema...

I think that's still probably the best route. We want to keep open source data as open as possible, so I don't think locking down API's etc is the right route. We do throttle API requests and scraping traffic, but then again there have been plenty of posts here over the years from people annoyed at hitting those limits so it's definitely a balancing act. Love to know what folks here think though.

david_allison|3 days ago

> when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts.

This isn't my experience. I requested that you looked into a spammer in July 2025, you ignored my reply and the account is still active.

----

Thank you so much for the report. We're sorry to hear you're receiving unwanted emails, but it's always a possibility when your public contact information is listed on the web. You can keep your email address private if you wish by following the steps here:

Setting your commit email address

We do expect our users to comply with our Terms of Service, which prohibits transmitting using information from the GitHub (whether scraped, collected through our API, or obtained otherwise) for spamming purposes. I'm happy to look into it further to see if we can contact the reported user and let them know that this type of activity is not allowed.

Please let us know if you have any other questions or concerns.

----

My reply which was ignored:

----

I understand it will happen from time to time. I'd rather be contactable (I've received legitimate emails today because my email is on my profile).

Please take further action. My email is public with the expectation that the ToS will be enforced. If GitHub isn't discouraging spammers then it makes it much harder to justify being contactable.

All the best, David

retlehs|3 days ago

I’ve made over five reports for this exact spam scenario, and never once have y’all acted on them. I have a hard time believing you ban spam accounts that clearly violate your ToS.

I even wrote about a specific example of a YC company spamming me from my GitHub email at https://benword.com/dont-tolerate-unsolicited-spam

koito17|3 days ago

I don't have any specific suggestions, but I do want to give thanks for implementing functionality to block pushes if the email field is *not* using an anonymized mail address.

It's one thing to offer anonymous e-mail addresses, but it's also awesome that GitHub can help prevent mistakes that would otherwise leak a user's e-mail address. I am not sure how many people try to be privacy conscious on GitHub, but I assume most users don't, so it's nice seeing this little feature exist.

ayhanfuat|3 days ago

I am also getting constant spam because apparently they can see who starred a repo (i.e. I see you starred repo x and we are doing something similar). I am not starring anything anymore.

skwashd|3 days ago

I know it is against the ToS. I've reported multiple organisations doing this. Last time I reported one, support closed the ticket saying the activity is off platform so they can't do anything.

blobbers|3 days ago

Scrape once, spam forever.

I think it's pretty clear you need to use an anonymization scheme in the way commits are handled so that it links back to your github account and the email addresses are kept private.

Privacy centric companies like Apple do this for users offering hashed emails, on a per login basis.

I'm sure this would not work in a world of scraping, but having that kind of ability to figure out bad actors would be nice. You could require authenticated users for certain kinds of requests, and block user information from non-authenticated requests.

realityloop|2 days ago

I've received several of these types of messages including Voice.ai one mentioned in comments, and the following today:

Tonho<tonho@tonho.wtf>

Hey, I found your GitHub profile and thought you might find this useful.

I've been building Omniget, a desktop downloader that works with YouTube, Telegram, Udemy, Hotmart and 1000+ other sites. It's open source and built with Rust and Tauri.

The part I'm most proud of: you don't even need to open the app. Just press a hotkey and it grabs whatever video you're watching.

I've been working on this for a while now, even got an artist to design a mascot. I'm shaping the app based on feedback from people who actually use it, so if you have any thoughts I'd love to hear them.

Here's the repo: https://github.com/tonhowtf/omniget

Thanks for your time!

Tonho

AznHisoka|3 days ago

Maybe I am missing something, but can’t you simply not show the email address in a git commit? (Sincere question, not saying this is trivial. i am dumb and like to ask dumb questions even if might be embarassing)

If someone wants to message someone, it goes through github notifications or github emails them

Also banning an account doesnt seem like a heavy punishment, given they can simply move to gitlab, bitbucket etc

just6979|3 days ago

What section of the ToS prohibits this? In other words, what is the thing that is being done that is against the ToS? Looking up the creator of a repo, or the contributors of the repo?

I did a quick scan of the ToS and all I could find was D8 that states that autmated access (scraping) used for "AI" applies a reciprocal license that prevents the scraper from restricting GitHub's access to the data (the whole model? the weights?) resulting from the scraping.

This makes it sound like any model trained on GitHhub content cannot be commercialized, because charging for access to the output would be a "technical or other limit"... So you're obviously not really enforcing this, otherwise MS would be suing every big commercial model out there!

shawmakesmagic|2 days ago

FYI I get about 5 of these a week. It is pervasive. If someone wants to scrape my email that's one thing, but the number of recruiters who are like "I saw your repo <some ancient repo of mine> and I think you'd be a great fit for our new position in AI agents..." so they are both scraping my e-mail and all the metadata to personalize their pitch to me (poorly).

ericol|3 days ago

I've had more than a few instances of this over the past 2 years, and my reply is exactly the above.

"What you are doing is against Github's TOS"

TheSaifurRahman|3 days ago

Are no-reply emails associated with the accounts if the username is changed? That's one reason why I switched back to my personal email.

Foxboron|3 days ago

I have reported several spam emails to Github and from what I can tell none has been acted upon.

dent9|3 days ago

Amazon did this to me. Their recruiters started hounding me at an email address that I only ever used to sign git commits on some repos used on GitHub. When I asked them how they got my email address they said "it was in [our] database"

trympet|3 days ago

Nice, thank you Martin. How do you punish the fraudsters? Do you send them to prison over CFAA violation terms of service?

miki123211|3 days ago

I've raised this as ticket ID 4114793, just in case.

blibble|3 days ago

> it's not technically difficult even if it is unethical.

kettle, pot, black?

I received the following offical spam last week from GitHub:

> Build AI agents with the new GitHub Copilot SDK

despite never granting consent for marketing material

(and yes, there's a GDPR complaint now working its way through the national regulator)

moomoo11|3 days ago

Ban them. Honestly I get the same and it is beyond frustrating.

I will pay more for GitHub if you go hard on these mfs.

observationist|3 days ago

Hey, Martin - https://github.com/lucidrains

Mind fixing lucidrains account? Something happened without notice or recourse. He's one of, if not the most well known open source AI researchers on the planet, with implementations and explanations of papers and ideas that are wonderful. If you could bring some sanity to that situation and take it out of whatever kafkaesque account purgatory it fell into, you'd be doing the work of angels.

Thanks!

scottydelta|3 days ago

YC is a proud investor in Flock, what YC Ethics thing are you talking about?

otherayden|3 days ago

And that Optifye.ai demo with the sweatshop surveillance software

cassonmars|3 days ago

And Cluely

wslh|3 days ago

And, Gecko Security.

ls-a|3 days ago

[deleted]

keiferski|3 days ago

I've spent a lot of my career marketing to developers, and spamming their GitHub account might be top 1 or 2 worst marketing tactics you can use.

Cold emailing rarely works by itself. Cold emailing developers via emails you pulled from their GitHub accounts? At that point, you're actively harming your brand, and may as well just send them spam diet pill ads.

RandallBrown|3 days ago

If someone took the time to look through my GitHub contributions then pitched me with a job relevant to that work I would absolutely consider them. That's exactly the kind of recruiter I would like to work with.

If it's obviously just a bot scraping emails and sending generic job requests, that's very different.

polishdude20|3 days ago

Wait why? That seems like the high effort and high specificity thing that I'd love to get.

You searched for people who do what you need to have done, found me, looked at what I've worked on and determined I'd be a good fit and you reached out? That's the number one way to get me to want to work for you.

an0malous|3 days ago

Ever wonder why YC has the "Describe a time you most successfully hacked some system to your advantage" question? It's because they select for founders that are willing to take advantage of legal gray areas. Airbnb repeatedly violated Craigslist terms of service and called it "growth hacking." Reddit stole content from Digg and faked users. OpenAI trains their models on copyrighted content.

unfunco|3 days ago

I also had unsolicited spam from Vincent Jiang of Aden, another YC company.

    Hi Daniel,

    I just came across your profile on social media and wondered if you'd be interested in joining our Discord community for AI agent development. Currently, we see that agents break, loop, get lost, hallucinate, and cost a fortune, and therefore built a space where developers can share challenges and insights.

unfunco|3 days ago

…and more from Backdrop.

    Hi Daniel, I found your GitHub profile while searching for anthropic projects, and got your email from your profile.

    I'm part of an online program for builders called Backdrop Build, and I think that program would be a great fit given what you are building. We have a track for builders in AI like you, it's fully online/remote and costs nothing to participate. It also works if you have a day job, it's light on time and perfect for side projects!
And then another after I marked the first one as spam and ignored it.

    Checking in one last time to see if you have any questions about the program or the application. If it's not for you, all good - just ignore the email because I won't be pinging you again :)

   Joey from Backdrop
Both companies have guaranteed that I won't use their services nor procure them for any organisation I work for.

foldr|3 days ago

I had a similar one from that guy asking me to make open source PRs to some repo of theirs for, err, $25-50/hour. I replied explaining that senior software engineers in the UK aren’t quite as desperately poor as that, and got a canned response saying that they were looking forward to reviewing my PRs :D

cyann|3 days ago

Got this spam today on my GitHub address, YC affiliated:

From: henry@joincactuscompute.com

Hey,

I hope all is well with you, just reaching out as you seem to be interested in on-device speech models.

Cactus is a low-latency AI engine for consumer devices like phones, Macs, wearables, Raspberry Pis, etc.

We support transcription models like Whisper & Parakeet, benchmarks available in the attached GitHub repo.

GitHub: https://github.com/cactus-compute/cactus

We are keen to get your feedback, and star if feeling generous.

Thanks a million

ignoramous|3 days ago

> star if feeling generous ... Thanks a million

A 419 scam?

mattpal21|2 days ago

Atleast they didn't ask for stars lol, but great to see how fast they're iterating!

elwebmaster|3 days ago

Just got a SPAM email from a Github scraper while reading this thread:

From: james@techglobal.website Quick note – your GitHub profile Hi X,

I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out.

Profile:

I run a technical team (full-stack, cloud, DevOps) that delivers for clients. We're looking to work with an engineer based in the US on client-facing coordination—discovery, requirements, alignment—while we handle delivery. If that might be relevant, I'd be glad to set up a short call.

Regards, James

If I had to guess, "James" is a North Korean looking to scam US clients, based on my experience with shady actors.

max__dev|3 days ago

Checked my spam after seeing this thread and found the same sender/email. Subject and signature are slightly changed.

From: james@techglobal.website Brief note – Following up on your GitHub work

Hi ,

I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out.

Profile:

I run a technical team (full-stack, cloud, DevOps) that delivers for clients. We're looking to work with an engineer based in the US on client-facing coordination—discovery, requirements, alignment—while we handle delivery. If that might be relevant, I'd be glad to set up a short call.

Best, James

vintagedave|3 days ago

I'm curious, what leads you to North Korean from that email? Is it that there's an anonymous team, which has a US "front"?

bakugo|3 days ago

This sounded familiar, so I checked my inbox and I did indeed receive a similar email from sanchitmonga@runanywheresdk.com earlier this month:

> I came across your GitHub profile and thought you might be interested in what my team and I are building. We're developing an open source SDK that runs LLMs directly on-device.

What's even more interesting is that both buildrunanywhere.org and runanywheresdk.com show a stock hostinger parking page when accessed in a browser. Something tells me they're intentionally registering these "alternate" domains specifically for spam, to avoid tanking the email reputation of their main runanywhere.ai domain.

I guess I shouldn't be surprised given YC is going all in on AI and most AI companies are no better than the crypto scammers of yesteryear, but still.

Imustaskforhelp|3 days ago

I observed the same thing and it was only when you told me the main domain that I found their website.

> Something tells me they're intentionally registering these "alternate" domains specifically for spam, to avoid tanking the email reputation of their main runanywhere.ai domain

This is a really bad look on them.

https://www.whatsmydns.net/domain-age?q=buildrunanywhere.org and https://www.whatsmydns.net/domain-age?q=runanywheresdk.com

Both these domain were registered only 36 days ago

Their main domain had been around for 6 month (216 days) tho:- https://www.whatsmydns.net/domain-age?q=runanywhere.ai

(I also couldn't see any post created by them on YC checking algolia from their website fwiw)

Seeing their star history on their product, I see some few interesting observations[0] Their star history was almost horizontal between december and february until it got vertical all of a sudden.

[0]:https://www.star-history.com/#runanywhere.ai/runanywhere.ai&...

I looked through their linkedin and found this website owned by them as well https://www.openclawpi.com/ and using the YC brand here as well. (registerered 26 days ago)

This website looks fairly AI generated to me as well and there are some bugs within the original website as well which I am now incredibly more unsure of if generated by AI or not given the similarities between the two websites UI/UX as well.

kristoff_it|3 days ago

I have received over the years so much spam of this kind by multiple YC-funded companies that I now reflexively send to spam any email that mentions being YC-funded, regardless of how legitimate the email is.

AznHisoka|3 days ago

Same here, having YC attached to your name is not the flex you think it is, its even the opposite for me

neya|3 days ago

I don't blame you, the FOMO is real to the point even basic ChatGPT wrappers are getting funded these days, I guess.

neya|3 days ago

This is atleast fine as it's just spam, I got pulled into an actual scam and it never made it to the frontpage.

https://news.ycombinator.com/item?id=45357205

medi8r|3 days ago

But that is someone pretending to be YC which is sort of less interesting than a YC company doing something bad. Because phishers imitate legit companies all the time. Easy to get roped in and I sympathise, anyone is suseptable (today I almost clicked the phishing training email as it looked urgent and pushed the right buttons)

ChrisMarshallNY|3 days ago

Looks like GH nuked it, though.

Hope they didn’t get too many folks.

nubinetwork|3 days ago

That's a little creepier than the time I got an email from someone trying to push a new crypto coin to me because I contributed to OSS.

c16|3 days ago

Email address privacy is a feature offered by Github and replaces your day to day email: https://docs.github.com/en/account-and-profile/how-tos/email...

efreak|3 days ago

Unfortunately if you don't start out using that, then your email address is already spread across the web. And back when I was looking at gitlab/bitbucket/etc for feature comparison, each forge used their own domain and couldn't be persuaded to combine commits from multiple addresses into your own profile (to be clear, that's not really necessary, but it does make it more difficult to find a commit created by someone when their commit address isn't the address associated with their account)

dewey|3 days ago

This happens all the time, not really surprised as the GitHub API makes it pretty easy to extract valuable leads with real and confirmed email addresses.

progbits|3 days ago

I don't like this way of putting it, it's good the github API makes this easy as that makes it an useful. Should not try to imply this should be restricted just because of some bad actors. It's just going to annoy legit users and the bad ones will scrape anyway.

tommoor|3 days ago

Yea, been going on at least a decade

callamdelaney|3 days ago

YC is basically advising their startups to engage in shitty business practices, like trying to hire UK staff for half the salary and expecting 7 day weeks.

roryirvine|2 days ago

Interesting - it tracks with personal experience.

Honestly, I'd chalked it up as a one-off mistake by an inexperienced team (I had discussed my expected range in our first conversation, so found it odd that they they would waste their own time going through the hiring process only to make me such a stupidly low offer!)

So is this something that they're actually being advised to do? What's the intention behind it?

WhatsName|3 days ago

Doesn't YC have some code of conduct or legal/ethical guidelines? I would assume a legal and compliance department would have some major headache if documented cases of misconduct jeopardize later due diligence. I would not fund or aquire a company on the radar of national regulatory bodies for something as stupid as this.

stevekemp|3 days ago

It's not "spam", it's a "growth hack".

devmor|3 days ago

Looking for ethics in an industry where a pluraility of founders are tied to Peter Thiel is a headscratchingly dense idea.

Goronmon|3 days ago

Doesn't YC have some code of conduct or legal/ethical guidelines?

Regardless of any claims of having this, I would say this behavior aligns with what I have seen over the last couple decades. I'm more surprised that other people would expect anything different?

thinkingtoilet|3 days ago

Like every other VC firm, the only thing they care about is money. They can pretend to morals, but they will never sacrifice one for the other in any meaningful way.

buellerbueller|3 days ago

Imagine thinking in 2026 that an American tech company has ethics.

Rapzid|2 days ago

If it were taking up time and not producing results then they would care.

whalesalad|3 days ago

When you are a team of 3 people eating ramen there is no legal or ethical compliance department.

mbesto|3 days ago

> Doesn't YC have some code of conduct or legal/ethical guidelines?

Sorry but lol you must be new here.

ttul|3 days ago

Didn't AirBnB famously spam people in the Bay Area as a "guerilla tactic" to build the business in its early days? This kind of fast and loose behaviour seems standard.

dathinab|3 days ago

As a side note unsolicited advertisement of this kind is illegal in Europe.

And them claiming "they didn't know" can be dismissed given that many dev on GH have location information set.

It also in general doesn't change anything. the law doesn't care if you know or didn't.

Startups starting out their journey by committing crime is always a grate sign for their trustability.

ChrisMarshallNY|3 days ago

I’m not especially bothered by this [yet -AI is likely to make this worse]. It’s a fairly insignificant component of my spam catcher. At least, it’s a bit focused.

Every day, I get deluged with hundreds of spam and scam emails, often because some knucklehead entered my email in a form (either accidentally, or as a throwaway red herring).

Maxious|3 days ago

Sure but these YC spammers are identifiable and have much more to lose https://www.ycombinator.com/ethics/

> Some examples of ethical behavior we expect from founders are:

> - Not spamming members of the community

> To maintain our community, if we determine (in our sole discretion) that a founder has behaved unethically during or after YC, we will revoke their YC founder status. This includes access to all Y Combinator spaces, software, lists and events. All founders in a company may be held responsible for the unethical actions of a single co-founder or a company employee, depending on the circumstances.

mattpal21|2 days ago

Also I found this gem in my inbox - not just YC companies :/

""" Hi there!

I noticed you’re interested in on-device AI development and wanted to flag a new bounty program we just launched with Qualcomm. We’re looking for developers to build a local Android AI app (using the Nexa SDK). Since you're already exploring this space, I thought this might be an easy win for you.

The Bounty at a glance: - Prizes: $6,500 cash pool + Flagship Snapdragon devices. - Perks: Direct partnership & marketing spotlight from Qualcomm (huge for visibility) - The Ask: Build a working Android AI app that runs locally.

Registration is open now: https://sdk.nexa.ai/bounty

I want to help you win. Once you register, please reply to this email. I’d be happy to advise on your ideas to increase your chances of winning. Or, if you have an existing project, I can guide you on how to port it to NexaSDK for the submission

Best, Lynn @ Nexa AI """

mattpal21|2 days ago

Yo, I also got the email:

""" Hi Matt,

I found your GitHub and thought you might like what we're building. We're developing an open source SDK that runs LLMs directly on-device.

We're getting about 45 tokens per second on iPhones, with support for Swift, Kotlin, React Native and Flutter. There's also a fully offline voice pipeline built in, so everything runs locally. We recently got into Y Combinator and are focused on expanding support to more edge devices and continuously improving performance.

If you're curious, here's the repo: github.com/RunanywhereAI/runanywhere-sdks

Feel free to reply to this email with any feedback or ideas you'd like to explore with on-device AI, or if you'd be interested in contributing. I'd love to hear your thoughts.

Best, Aditya """

Just to share the entire email, I think it's pretty well written, I went ahead and talked to the team, they were very curious and took my feedback regarding their flutter sdks very seriously, and they seem to be great people. Also, just an fyi, I tried their sdks, it's great! and I've been loving their apps as well.

I think their team is great, and I asked them for adding the rag implementation, they did it in less than week and it's pretty impressive. I think it's worth checking it out, It's easier to demean someone in public like that but might be worth checking.

coffeecoders|3 days ago

For me, its those Who's hiring or Who wants to get hired posts. I used a throwaway email once and got emails about SEO and AI projects.

I don’t engage. I mark as spam, block the sender/domain, and move on.

theturtletalks|3 days ago

General advice would be to mark the email as spam or junk and hopefully their email platform penalizes them, but this has been working less and less. Email has truly become pay to play now.

suyash|3 days ago

That's exactly what I've been doing with solicitation emails, reporting as SPAM on gmail.

ergocoder|3 days ago

We all use different domains for sending cold outreach. This isn't an amateur hour, come on.

csense|3 days ago

I find it interesting that a substantial number of people seem to think it's wrong or unethical to cold-email someone about a potential recruitment or business opportunity if they post their email in a public place, such as commits in a public Github repo.

I feel like if you don't want companies to cold-email you, you shouldn't make your email public. Github provides noreply email addresses for this purpose.

heikkilevanto|3 days ago

> I find it interesting that a substantial number of people seem to think it's wrong or unethical to cold-email someone about a potential recruitment or business opportunity if they post their email in a public place

I find it interesting that some fucking spammers think that just because they found out my email somewhere, they should be allowed to waste my time and resources for their shit.

That is explicitly illegal here in EU. Unless I have clearly given you my consent, you are not allowed to spam me. Is informed consent really such a difficult concept to understand?

16B5775dTgZ|3 days ago

That isn't how consent works, though.

Scraping emails is also against the GitHub terms of service.

If you don't know what jurisdiction the owner of the email address resides in, it may also be illegal.

So whether it is scraping emails off a website or finding yourself on a private island with beautiful people "made available" to you, "consent" requires more than just having access.

scosman|3 days ago

I’m also getting “saw you on GitHub” spam from voice.ai

And they are using a different domain for the emails so the spam markers don’t hit their primary domain.

pscanf|3 days ago

I was also spammed (twice) by voice.ai.

You mention GDPR, which also "applies" to me, though I wonder if what they're doing is actually illegal. I mean, after all, I'm putting my email on GitHub precisely to give people a way to contact me.

Of course, I do that naïvely, assuming good faith, not expecting _companies_ to use it to spam me. So definitely what they're doing is, at the very least, in poor taste.

notpushkin|3 days ago

> I'm putting my email on GitHub precisely to give people a way to contact me.

They’re not only looking at the public email in your profile, they’re also looking at your committer email (git config user.email). You could argue that you’re not putting that out for people to contact you.

(I’ve used that trick a couple times to reach out to people, too, but never mass emailing.)

zvqcMMV6Zcr|3 days ago

Is there any company that will take my money to solve GDPR issues? And by solve I mean sue the spammers? For last few years I saw they "try" to look legit, by claiming addresses are managed by some Hungarian/Spanish shell company, hoping no one will be able to afford pursuing infractions over borders.

EdNutting|3 days ago

My solution to this is to use a Github-specific email address. All emails sent to that address which do not originate from GitHub are immediately reported as spam, marked read and deleted.

I sometimes use different git/GitHub addresses depending on who I'm working for or specific projects so I can more accurately detect where data is being scraped from.

EdNutting|3 days ago

N.B. Using service-specific emails is trivial - you don't need separate email accounts. Just use email aliases, e.g. "john.smith+github@gmail.com" -- which is an alias called "github" for "john.smith@gmail.com"

insane_dreamer|3 days ago

I get these types of emails daily -- never bothered to check whether they are YC or not as I don't read them; I can tell from the first sentence that it's not a company I know and am doing biz with and it goes directly into z-file. Most seem to have gotten my email address from LinkedIn, others from GH.

Side note but the trick I learned, at least with gMail is not to delete the email (which doesn't prevent you from getting new ones), or even reporting as spam (which may or may not work), but instead dragging it into the Promotions tab, into which all future emails from that email address will automatically go. Promotions tab then acts as your Trash.

The quickest way to get me to never do business with you is to send me spam.

oefrha|3 days ago

Yes, startups, recruiting platforms, and students/“researchers” with stupid surveys for their worthless “research” spam me all the time by scraping the email from GitHub. I immediately trash the first two categories; I send a sternly-worded reply to the third category.

mustaphah|3 days ago

Even worse, I got contacted through YC Jobs (workatastartup.com) with a message that was basically: "Star, fork, and submit PRs to our open-source repo and we'll review you for a contract."

I immediately realize it's engagement farming + free labor. I said "No thanks."

Got this reply: "(...) I'm looking forward to reviewing your PRs. Feel free to share me any of your questions. (...)"

Apparently, no one read my reply - not even AI. They are automating this shit. It's sad that many fall for it (check their Github repo)

---

Company: Aden (W20)

Contact: Vincent Jiang, Founder

Github: https://github.com/aden-hive/hive

tock|2 days ago

Yep I got the same message on workatastartup.com from Aden.

lordgrenville|3 days ago

Maybe a dumb question, but isn't this trivially solved with this .gitconfig?

    [user]
         name = lordgrenville
         email = <some_kind_of_id>+lordgrenville@users.noreply.github.com

darknavi|3 days ago

Sure, as long as you want to rewrite all of the history of all of your public repositories.

haute_cuisine|3 days ago

Not all projects are hosted at github. You also might want to receve relevant mail from fellow developers.

ktm5j|3 days ago

Perhaps, but it doesn't change the fact that this is bad behavior for the company sending the email. Since YCombinator funded this company it makes sense that YC would want to know about how they are conducting business.

6thbit|3 days ago

I wish github could ammend the email of my commits to the private noreply address during push so they _never_ have any other email associated to them. May not be feasible due to the commit changing, confusing local branch and such?

They have this other thing where they reject pushes for the 'known' emails you've told them you have, but kinda seems there should be a setting to do that for any email that is not your noreply private one. is that a feasible thing to ask for?

cperciva|3 days ago

If you change the email address, you change the commit hash. And yes, suddenly your local branches are orphaned.

Of course, there's nothing stopping you from using a git-only email address (nospam-6thbit@yourdomain) and routing that to /dev/null. GitHub can't change email addresses, but you can.

arcfour|3 days ago

They literally have a setting to block pushes with any email other than the noreply one, lol.

agcat|2 days ago

This is so weird and true. The most unfortunate thing is that a lot of these data enrichment platform where they encourage these workflows but its clear that end person doesn't appreciate it.

jazzpush2|3 days ago

That's nothing. Former/current YC founders are also abusing BookFace.

I did YC and now work at a frontier lab.

I've received multiple spam-style emails from (mostly young) current founders tagging me and all other YC-alum at my place-of-work with the profiles of their friends for internship roles, referrals, etc.. Same girl has done it for like 5 different people.

b8|3 days ago

Boundaries don't exist really in tech and especially with emails. I just filter out spam and block a good bit. People just ignore stuff now a days even people saying hi passing someone in the street (which I stopped doing)? My colleges spam filter catches a lot of them. Your email is presumably already in data dumps.

danbrooks|3 days ago

I got some emails like this from overseas developers looking to borrow my Linkedin to land a higher paying job.

ttoinou|3 days ago

Couldn’t github replace all public commits author info email by a username@author.github.com email automagically ?

jonathanlydall|3 days ago

You can’t change anything about a commit without breaking the chain of SHA hashes in the commits, which causes pulls to break.

GitHub hides the emails on their web UI, but nothing stops people from pulling the repository with a Git client and looking at the emails in the commit log after doing so.

arcfour|3 days ago

You have to configure your own Git client manually. But you can configure GitHub to block pushes from any email other than the no reply email GH generates for you.

LeoPanthera|3 days ago

They scrape "Show HN" as well. I got put on a list and continue to get spam to this day.

sieep|2 days ago

I consider any company funded by YC to be engaging in legally grey or fraudulent activity.

ting0|3 days ago

Change your email to something like: myemail+gh@mail.com (the "+gh" tag). You can put any tag/word there, and if you get spam from a company you'll be able to identify that it came from them scraping your GH. Then you can report it with certainty.

buellerbueller|3 days ago

you can also autofilter that tag to route to spam

jedberg|3 days ago

FYI, there are whole companies built around this concept. You tell them which repos are interesting to you, and they give you a list of people who interact with that repo. They also de-anonymize the users so you can find them on LinkedIn or elsewhere.

pmdr|3 days ago

People here assume that YC is some kind of ethics benchmark for business. It's not.

scirob|3 days ago

This sounds decently targeted, why is it so offensive? Email marketing is far more democratic than Superbowl ads, give a small company a chance it's not hard to build something without the Superbowl millions

apparent|3 days ago

Even before AI, I found it super annoying when I got spam from companies touting their YC cred.

They're literally hurting their own brand, as well as YC's.

rlaabs|3 days ago

I've received the exact same email from the same company.

j16sdiz|3 days ago

Over many years, I have got email from university for survey / research.

This is not GitHub only, I have got a survey on how my experience interacting with folks on lkml

oldned|2 days ago

one thing we can do: - mark it as spam. if enough people do this it does have an impact.

something GitHub can do: - offer an email address like [spam@github.com] so we can easily forward suspect TOS violations.

outloudvi|3 days ago

I usually check the "Received" header and report to the email service provider. Once in a while I receive a response saying the case is properly handled.

These providers are the only ones that care about their reputation and thus may take some action. Investors? Nope.

john_strinlai|3 days ago

the problem is that the emails arent typically sent from the main domain.

in this example, the email came from buildrunanywhere.org, which is just a parked domain. the real domain is runanywhere.ai, which they arent using for spam.

so, once buildrunanywhere.org has their reputation burned from reports, they will simply register buildrunanywheres.org and start spamming again.

dariubs|2 days ago

But is it ok to send email to your repos stargazers?

malmeloo|3 days ago

Oh I'm getting so tired of this. Lately there appears to have been an uptick in this kind of marketing spam too, there's so many companies trying to advertise their AI products this way. At least it's a good indicator of which companies I should avoid at all costs, and it provides me with an email address I can use to direct my angry emotions towards.

They're getting more aggressive at it too. Just yesterday I received an email from Alignerr (not YC affiliated I think) saying that my sign-up was complete and cheerfully welcoming me to their platform. I had never even heard of them. An automated "job opportunity!" email didn't arrive until 3 hours later, but by then I had already directed some angry words towards their support email.

Other, even less respectable projects are also regularly enrolling my GitHub projects into their platforms, and I have to actively reach out to them to remove it.

I'm so tired of this man. Can someone go and take away these organizations' ability to send emails?

nektro|2 days ago

first time I'm hearing that this is frowned upon. i usually ignore or politely decline

dukeofharen|2 days ago

You can add Alignerr to the list as well.

jacquesm|3 days ago

Sometimes they also scrape HN profiles, it is most irritating.

vexorkai|22 hours ago

saw this and got paranoid about my own repos. checked the commit history and sure enough my personal email was plastered across years of commits. spent a couple hours hacking together a scanner — github.com/vexorkai/git-shield. runs locally, tells you which repos are leaking your email and how to fix it going forward. it's my own project fwiw, nothing fancy but it does the job.

nprateem|3 days ago

There's no reason to put your real email in git config unless you're signing, in which case repos should be private. I would have thought that was obvious.

ellieh|2 days ago

this happens to me so often that I wonder if it's something YC suggest people do

suprjami|3 days ago

Big deal, so does every other company.

If you're lonely just upload a few AI keywords to a repo. You'll get emails forever.

axegon_|3 days ago

I've received several similar ones over the years. At this point, if I get an email from someone I don't know and it contains a link, chances are it's spam. I genuinely doubt github(or any other company for that matter) would do something about it. While I fully support GDPR, the truth is, few people are willing to take action knowing how much bureaucracy would be involved...

dagi3d|3 days ago

> how much bureaucracy would be involved... it varies from country to country, but filling a complaint on that matter is usually quite straightforward

tom_m|3 days ago

Happens all the time.

rodrigodlu|3 days ago

I did receive these kinds of emails as well.

And I use a different email fromy priority email for GitHub commits since 4 years ago.

So just stop with marketing slop please.

Yes, I work with AI, and I'm becoming pretty good at it.

But this doesn't mean I'm comfortable pushing AI slop into potential users and customers.

I (and they) want to use AI to facilitate their processes, not to ingest slop content.

koakuma-chan|3 days ago

I have been having the same experience. If you starred a GitHub repo, and they think that their product is similar, they will send you their spam. I condemn this! They should be ashamed!

lyu07282|3 days ago

After 25 years on the internet dealing with spam, it would never even occur to me to invest the energy to write a letter to the offending companies investor. But more power to them I'd say!

Rapzid|2 days ago

Bruh, they are probably using another YC company that provides this service.

hmokiguess|3 days ago

HN and YC walk a thin line between hacker culture and venture capitalist culture. I know it’s easy to think that because HN comes from YC them too are aligned with hacker culture, but no. YC is all cutthroat business.

alexchantavy|3 days ago

Partial agree. YC created HN, though the HN community is very much _unlike_ anything I've seen at YC.

HN is deeply skeptical, technical, cynical, sarcastic. It's a great place to learn new things and I've loved it since I found it in 2012.

The current startup climate (not just limited to YC) feels very AI bro YEAHHLETSFUCKINGGOO (and I say this as a founder myself having gone through YC recently in W25).

idoxer|3 days ago

I also received this shitty email 3 days ago

atfzl|3 days ago

[deleted]

speedgoose|3 days ago

Why would you promote spam?

bilekas|3 days ago

This is some next level spam posting. Not sure to be annoyed or impressed.

RobotToaster|3 days ago

I feel like spam is somewhat less offensive when it's for FOSS, assuming it isn't some faux FOSS freemium scam. It's about the only spam I wouldn't mind getting.

ValentineC|3 days ago

> These emails indicate that those companies scrape people's Github activity, and if they notice users contributing to repos in their field of business, send marketing emails to those users without receiving their consent. My guess is that they use commit metadata for this purpose.

There are likely marketing email datasets floating around the internet that contain email addresses scraped from commit metadata.

I use a catchall with a specific Git client (not GitHub) email address, and found spam and phishing emails being sent there quite a few times.

input_sh|3 days ago

May not necessarily be from commit messages, there's at least one way simpler way: simply adding .gpg to the end of any user URL will return that user's public GPG key.