The absolute solution for that is force contributors to sign CLA, and I don't think there's a way to sign that anonymously. I know a lot of smaller projects wo

The absolute solution for that is force contributors to sign CLA, and I don't think there's a way to sign that anonymously. I know a lot of smaller projects won't bother with CLA, but their maintainers can still assess the possibility of stolen code and act accordingly. If I'm a maintainer and the possibility of an incoming PR is stolen (the complexity of the PR, basically) is high enough, I would look at the information associated with the contributor (the GitHub account, the email address, etc.). If it's someone contribute a lot to other open source projects I would be more likely to accept it. Actually on second thought, GitHub really should provide free CLA management service to all its users: you (as a project maintainer) can enable CLA requirement on your project, once enabled a GitHub-run CLA bot will ask new contributors sign a CLA in their first PR, and you can get all the signed CLAs when needed. If GitLab or BitBucket provide this feature before GitHub I'll move my projects over in a heartbeat.