Ability to delete uploaded files and/or disable file upload in Issues or PRs at org level

[erikr]

Users cannot delete files that are uploaded to GitHub issues or PRs. This lack of functionality poses business risks to users and alone is sufficient to prompt orgs to consider switching to GitLab or other competitors.

Requested functionality:

1. Ability to delete uploaded files
2. Ability to disable file upload into Issues or PRs at org level

The only mechanism I am aware of to delete uploaded files is to submit a request, but this is time-consuming and not always successful. For example, I am on the 5th round of correspondence with GitHub Trust & Safety, who keeps sending me boilerplate text and a URL to documentation that does not address the issue:

Our Private Information Removal Policy is intended to be used in situations where a security risk exists due to private information being posted in a repository that you or your organization do not have write access to and cannot remove yourself. In this case, it appears that all of the content you are reporting is found in repositories owned by the $ORG organization on GitHub, and that you are an employee of $ORG.

That said, we suggest that you reach out internally to the team(s) or individual(s) at $ORG who are responsible for maintaining the repositories that contain the private information. Repository maintainers should be able to completely remove the files from the repositories by following the process described below, which is designed for individuals or organizations who need to remove private or sensitive information from their own repositories:

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository

If your team runs into any problems following this process, please have them submit a request to our Support team at https://support.github.com/contact.

Thank you, and please let us know if you have any questions or concerns about this notice, or about our Private Information Removal Policy

Related post for a possible solution: #8547

[codeling]

This now seems to be actively exploited by malware (see e.g. https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/ or https://www.schneier.com/blog/archives/2024/04/using-legitimate-github-urls-for-malware.html)

github, are you planning do do anything about this? or will it be necessary to disable issues and PRs explicitly in every repository in order to avoid this? I would prefer an option to disable users from uploading any attachments in issues and PRs...