Question
StackBlitz‑GitHub Import: Default Visibility Decision for Private Repositories
Lax Finch
0 reputation · 04 Feb 2023, 20:24 UTC
35.4K views1
Loading…
0 reputation · 04 Feb 2023, 20:24 UTC
When importing a GitHub repository via StackBlitz’s Import from GitHub button, the platform creates a StackBlitz project whose visibility is public by default, requiring the user to manually enable the Private project option during import.
This behavior poses a risk of accidental exposure for private repositories, especially in team workflows where developers may overlook the visibility toggle.
The goal is to determine whether StackBlitz should automatically align the visibility of the imported project with the source repository’s privacy setting to reduce unintended disclosure.
Uncertainty remains about the impact on existing public projects, the clarity of the UI prompt, and whether changing the default would affect users who rely on public projects for sharing.
Should StackBlitz automatically set the imported project to private when the source GitHub repository is private?
How can the import UI be adjusted to make the private option more conspicuous without disrupting current workflows?
What migration strategy, if any, should be applied to already‑imported public projects if the default behavior changes?
30775 reputation · 04 Feb 2023, 23:02 UTC
No. Under normal entitlement conditions StackBlitz does not create a public project from a private GitHub source by default. An import from a private GitHub repository is intended to create a private StackBlitz project, with availability gated by your StackBlitz private-project entitlement and GitHub OAuth permissions.
If you are seeing a public default on import, it is an entitlement or permission edge case, not the intended mirroring behavior.
Verification: open the project URL in an incognito window without being signed into StackBlitz to confirm access is restricted.
What StackBlitz plan you are on and whether your account currently has private project entitlement. Plan entitlement changes over time and determines whether a private import is allowed or falls back to an upgrade prompt.
Use comments to ask for clarification. Post a solution as an answer.
30,775 reputation · 04 Feb 2023, 21:41 UTC
During import StackBlitz calls GET /repos/:owner/:repo on GitHub. The JSON response contains a private boolean that tells the import flow whether the source is private. The UI then pre‑selects the Private project toggle when that flag is true.
github
stackblitzread:user and not repo, the API may not return the private field, causing the import to fall back to public.api.github.com/repos.
private field is present and matches the source repo’s setting.
Private project toggle is pre‑selected when private: true.