> If so it seems like that's a relatively easy fix for Github, just check if the commit is actually contained in userB's fork of the repo. It's not that easy.

> If so it seems like that's a relatively easy fix for Github, just check if the commit is actually contained in userB's fork of the repo. It's not that easy. First of all, you'd need to define "contained in". The naive choice would be anything reachable by a named ref. However, all pull requests also create a ref in your repository, so you'd need to exclude those. But that would mean that if you make a PR and then delete the branch the PR is made from, the PR contents aren't visible anymore. But even if you have the set of refs that you consider to be in a repository, that means every time an object is requested you'll have to walk the whole graph backwards to find if an object is reachable from a ref. That's an expensive operation, and Git is usually pretty fast because it tries really hard to avoid this.