50+ repositories went offline in the middle of Google Summer of Code. Here's how our community kept moving, and how an unexpected project became our new home.
This one is a bit of a rollercoaster, so buckle up. 🎢
The calm before the storm
It was the middle of Google Summer of Code (GSoC).
OWASP BLT (Bug Logging Tool) had more than 50 repositories under a single GitHub organization. We had everything from the core application to Slack bots, a browser extension, a hackathon platform, a GSoC tracker, and a long list of tools built and maintained by our contributors.
Things were moving along nicely.
Mentors were reviewing. Contributors were shipping. Leaderboards were updating. The usual open-source chaos, but the good kind.
Then we decided to do some housekeeping.
Good security hygiene, right?
We applied an organization-wide GitHub ruleset to enforce consistent repository protections across all our projects.
A security-focused project enforcing security rules on its own organization.
What could possibly go wrong?
The morning after: everything was gone
We woke up to find our GitHub repositories offline.
All 50+ of them.
And here's where things got confusing.
At almost exactly the same time, GitHub itself was experiencing an outage.
So for several hours, we genuinely had no idea what was happening.
Was it our new ruleset? Was something wrong with the BLT organization? Was it GitHub's outage? Or was the timing just a coincidence?
We contacted GitHub support.
Then we followed up.
And followed up again.
Days passed, and we never received a clear explanation for what had happened to our organization.
Mostly, we got silence.
Meanwhile, Google Summer of Code wasn't going to pause for us.
Contributors had active branches. Mentors had pull requests waiting for review. Projects had deadlines.
When developers can't clone repositories or open pull requests, that's more than an inconvenience. It brings development to a halt.
We needed another option.
Plan B: moving to GitLab
Rather than keep waiting for answers, we moved our repositories to GitLab.
We pushed the code, redirected contributors to the new location, and worked on getting everything running again.
Repositories were accessible. CI pipelines were migrated where possible. Contributors could get back to work.
It wasn't the migration we'd planned.
Actually, we hadn't planned a migration at all.
But the community adapted, and development continued.
We still wanted our original GitHub organization restored, of course.
We kept reaching out to GitHub over the following months.
Unfortunately, we still didn't get a clear answer.
An unexpected plot twist: Kaif built a Git forge
Here's where the story gets interesting.
Some time later, we learned that one of our community members, Kaif, had built something of his own.
While we had been dealing with the fallout of losing access to our GitHub organization, Kaif had turned the situation into a project.
He built ForkMesh, a self-hosted Git forge.
Think of it as having your own GitHub-like platform, with:
- Git repositories and code hosting
- Issues and pull requests
- Actions-style CI/CD workflows
- Support for AI agents as first-class collaborators
- The ability to run your own instance
The funny part?
We hadn't set out to build or commission our own Git hosting platform.
We had moved to GitLab to keep things going, and later discovered that someone in our community had built an entirely different option.
So we gave ForkMesh a try.
And it stuck.
From 50+ repositories to one home
Today, OWASP BLT has a very different setup.
Our official source of truth is now git.owaspblt.org/BLT, running on ForkMesh.
And we took the opportunity to do something we'd wanted to do for a while: consolidate our projects.
### One repository, all our history
Instead of maintaining 50+ separate repositories, BLT projects now live together in one repository, organized into their own folders.
We preserved their commit histories along the way.
That means:
- 45,000+ commits preserved
- 260+ contributors represented
- Projects organized in one place
- One central home for issues, contributions, and development
That's a lot of community history, and we wanted to make sure it came with us.
### GitHub is now our mirror
Yes, you read that correctly.
GitHub went from being our primary home to being our backup.
Our repository at github.com/OWASP/BLT is now a read-only mirror, automatically synchronized from our forge.
The source of truth is the forge we host.
Funny how things turn around.
### GitLab is archived, not forgotten
We didn't just abandon our temporary GitLab home.
Every open merge request was reviewed. Contributions worth bringing forward were merged into the new repository, with the original authors credited.
Other merge requests were closed with explanations.
Open issues were migrated to the forge, with references back to their original locations.
The GitLab repositories remain archived so old links and project history are still accessible.
### A little cleanup along the way
We also used the migration as an opportunity to clean up some technical debt.
For example, scheduled data jobs now write to Cloudflare storage instead of filling the Git history with automated bot commits.
A bunch of little improvements that might not have happened otherwise.
Sometimes an unexpected migration gives you a good excuse to fix things you've been putting off.
What this taught us
There are a few lessons we're taking away from the experience.
1. Don't put all your eggs in one platform
GitHub is an important part of the open-source ecosystem, but relying entirely on one platform introduces risks.
Your source code, issues, contributions, and project history represent years of community effort.
Having a backup is inexpensive. Losing access without an explanation can be extremely costly.
We now have much more control over where our work lives.
2. Test organization-wide changes on a smaller scope first
We still don't know exactly what caused our GitHub organization to become unavailable.
It would be unfair to claim the ruleset was responsible without confirmation.
But we learned something important regardless.
When making changes that affect more than 50 repositories, start small.
Test the behavior, understand the impact, and expand gradually.
Because when a large change goes wrong, the consequences can be just as large.
3. Open-source communities are remarkably resilient
This is probably the biggest takeaway.
What kept BLT going wasn't a particular platform.
It was the people.
Contributors continued working. Mentors kept supporting students. The community found alternatives.
And one community member went a step further and built a Git forge that eventually became our new home.
That's the part of open source we love most: people turning problems into opportunities to build something useful.
Come build with us 🐝
If you already contribute to OWASP BLT, or you've been thinking about getting started, our new forge is where the action happens.
👉 Explore the OWASP BLT repository
You can browse the projects, clone the repository, open issues, submit pull requests, and help us improve both BLT and the contributor experience.
We're still learning what works best with our new setup, and we'd genuinely appreciate feedback.
One more thing: we have a world 🌍
Because apparently moving 50+ repositories wasn't adventurous enough, there's also something fun to explore.
The forge comes with its own virtual world.
OWASP BLT has its own hex, complete with:
- A bug terrarium filled with websites that people have reported bugs on. You can walk inside through the door.
- A Hacker House you can enter and explore.
- A road connecting the BLT world to the neighboring ForkMesh world.
It's a playful little addition to what started as a pretty frustrating situation.
👉 Take a walk around the BLT World
We started with more than 50 GitHub repositories, lost access to them in the middle of GSoC, moved to GitLab to keep development going, and eventually found a new home thanks to something a community member built.
Not exactly the infrastructure roadmap we'd imagined.
But here we are: 45,000+ commits, 260+ contributors, one forge, and a community still building.
See you on the forge. 🐝
