Someone has your code in their public repository, maybe with your copyright headers stripped out and a stranger's name in the README. A GitHub DMCA takedown is the fastest remedy available: file through GitHub's official DMCA form, and a valid notice gets the repository disabled, usually within days.

Two things make GitHub different from other platforms, and both shape how you file. Every notice is published essentially verbatim in a public archive, so your name and your reasoning become a permanent, searchable record. And the fork system means a takedown of one repository does not automatically remove its copies. The sequence below covers the license check that decides whether you have a claim at all, the fork mapping, the evidence to preserve, the filing itself, and what to do when the owner pushes back.

First, Confirm It's Actually Infringement

Start by reading your own license. If you published the code under MIT, Apache 2.0, GPL, or another open-source license, copying is what the license permits, the license is the permission. The enforceable violations are narrow. Nearly every open-source license makes the copyright notice and license text travel with the code, so deleting them is a violation. Relicensing your code under a different author's name is a violation. Dropping GPL-covered code into a closed-source product without offering source is a violation. Skipping required attribution is a violation.

If the copier kept your notices, followed the terms, and simply built a competing project you dislike, you have no claim, and filing anyway publishes your mistake in a searchable archive, with misrepresentation liability under 17 U.S.C. § 512(f). The clean cases are wholesale copying with attribution stripped, proprietary source leaked or mirrored in full, and code you never licensed to anyone. Where GPL noncompliance is the problem, read how GPL enforcement works before choosing a takedown, because demanding source release sometimes fits the situation better than removing a repository.

Map the Fork Network Before You File

GitHub's takedown policy asks, inside the notice itself, whether you have investigated the reported repository's forks, because a takedown does not touch them automatically. A fork is a full copy living under a different account. Disable the parent and every fork keeps serving the content unless the forks are also named and disabled. Reporting one URL while twenty copies survive accomplishes almost nothing.

Do the mapping before filing. Open the repository's forks page and sort by recent activity; the actively maintained forks are the ones that matter, since a copy untouched since creation threatens you less than one with fresh commits. Open each fork you intend to name and confirm the infringing content is still present. That check matters most when the infringement is partial, if only certain files were copied, a fork may have deleted them, and blanket claims naming every fork will draw pushback. When the reported repository infringes in its entirety, say so in the notice: GitHub's policy permits disabling the whole network when the infringement is network-wide. Gists count too and can be listed in the same notice.

Preserve Evidence While the Repository Is Still Live

Once GitHub disables a repository, your access to its history disappears with it, so preserve everything first. A full git clone keeps the entire commit history, and history is often your best evidence: early commits tend to still carry your original copyright headers, and the commit timeline shows exactly when the uploader added your files. Commit metadata records committer email addresses too, which can tie an anonymous account to a person. Downloading the repository as a zip archive beats nothing, but it discards the metadata that makes the case.

Pair the clone with screenshots of the infringing files beside your originals, file paths visible. If your repository predates theirs, your commit history is the timeline that proves it, and dates are what reviewers actually weigh, our walkthrough of timestamp evidence covers what moves a decision. For what convinces reviewers, dated originals, registrations, development logs, read the guide to proving content ownership.

Filing Through GitHub's DMCA Form

GitHub's intake point is its DMCA form at github.com/contact/dmca, which routes your notice to the designated agent listed in the DMCA takedown policy. Email to that agent works, but the form is structured to match what the reviewer needs, which is why it moves faster. The form exists because 17 U.S.C. § 512(c)(3) fixes the minimum content of a valid notice, and GitHub, like every host keeping safe-harbor protection, must act on notices containing those elements: the safe harbor basics guide explains the bargain behind that.

Work through the elements in order:

  1. Identify your copyrighted work: your repository URL, project name, and its license or proprietary status.
  2. Identify the infringing material: the reported repository's URL, plus specific file paths where the copying is partial. Claim the entire repository only when it truly is.
  3. Answer the fork question with the results of your actual investigation.
  4. State the remedy the owner must perform: remove the material, or restore your license and attribution file.
  5. Add your contact information, the two sworn statements, good-faith belief in the infringement, and accuracy under penalty of perjury with authority to act for the owner, and your typed signature.

A notice template with line-by-line commentary gives you wording for each element. One check before submitting: if what you actually want is a paid license or a settlement, a takedown is the wrong instrument, and the comparison of a DMCA takedown versus a cease-and-desist letter covers when a letter serves you better.

Your Notice Becomes a Permanent Public Document

Since 2014, GitHub has published every DMCA notice and counter-notice it receives in the github/dmca repository, essentially verbatim, with limited contact details redacted. The transparency is deliberate: a public archive deters abusive takedowns, and it shapes every filing made against the platform.

Three consequences follow. Your name will be visible, so never use a home address; a business address keeps your personal details out of a permanent, indexed document. Your reasoning will be visible, so write the notice as if a journalist and a defense lawyer will read it, because both eventually do. And your mistakes will be visible: a notice claiming infringement over properly licensed use, or over code you turn out not to own, sits in the archive as evidence in a § 512(f) misrepresentation claim. When any part of your claim is uncertain, narrow the notice to what you are sure of. Understated notices hold up; overstated ones get quoted back at you.

After You File: What Happens and What the Owner Can Do

GitHub's reviewers screen the notice for the statutory elements and the merits. The process is fast by platform standards, typically days rather than weeks, and platform takedown timelines put GitHub near the quick end. On a valid notice covering an entire repository, GitHub disables it: visitors see a takedown page explaining the removal and linking to your notice, while the owner keeps a copy of the content and the option to respond. When the notice identifies specific files inside an otherwise legitimate project, GitHub may instead give the owner a short window, about one business day under its policy, to delete the flagged material and keep the rest of the repository. Defective or meritless notices get rejected, usually with an explanation you can fix; the guide on what to do after a rejected DMCA notice covers the common failure points.

The owner also has the formal counter-notice: a sworn statement that the material was removed by mistake or misidentification. Counter-notices are published in the same public archive, and they start the statute's clock. Under 17 U.S.C. § 512(g), you then have 10 to 14 business days to file a court action seeking to restrain the infringement. If you do nothing, GitHub restores the content. That option has a prerequisite: for US works, you generally cannot sue for copyright infringement until the work is registered with the Copyright Office, and registration takes time. The case for registering your copyright early explains why this becomes urgent fast. The full sequence, deadlines, evidence, what a federal filing must contain, is in what happens after a counter-notice. If the uploader is anonymous and you need a real name to sue, a subpoena under § 512(h) can compel disclosure; the § 512(h) subpoena guide covers when courts grant them.

The youtube-dl Lesson: Not Every Takedown Sticks

In October 2020, the RIAA obtained the removal of the youtube-dl repository, a widely used download tool, citing the DMCA's anti-circumvention provisions. The backlash was immediate, because the tool had substantial lawful uses, the principle that a technology with substantial non-infringing uses is not itself infringing traces back to the Supreme Court's Betamax decision. Within weeks, GitHub reinstated the repository, publicly apologized for the removal, overhauled how it reviews anti-circumvention claims, and created a legal defense fund for targeted developers. The full youtube-dl story is worth reading before you name a tool repository.

The lesson for filers is claim selection. When your literal code has been copied, the notice is about your code, and it holds up. When your complaint is that a tool can be used for infringement, a ripper, a scraper, a downloader, you are making a different and much weaker claim about the purpose of software, and GitHub scrutinizes those notices hard. Anti-circumvention claims under § 1201 get the most scrutiny of all. Name repositories containing your stolen code, not repositories whose function offends you.

Problems GitHub Routes Somewhere Else

Some repository problems look like DMCA cases but are not, and sending them to the wrong desk costs days. Leaked API keys, database passwords, and other credentials are a security issue, not a copyright issue; GitHub's private-information removal process handles those, faster and without any copyright claim.

Cracked or pirated builds attached to a repository's releases are classic DMCA territory. The fight against cracked software addresses that pattern, and game developers face its most common version, the DMCA for game developers covers cracked game builds specifically. Someone using your project's name or logo is a trademark problem, and the DMCA desk will decline it; trademark requires a different kind of notice. If the same code is mirrored on GitLab, Bitbucket, or Codeberg, each host runs its own process under the same law, and repo-by-repo reporting across all of them is normal.

Finally, GitHub terminates the accounts of repeat infringers under 17 U.S.C. § 512(i). If the same account has already collected notices, say so, a history of infringement is exactly what repeat infringer policies are designed to end.

Frequently Asked Questions

How long does a GitHub DMCA takedown usually take?

Review times vary, but GitHub sits among the faster platforms: a complete, valid notice is usually acted on within days rather than weeks. The form moves faster than email because it arrives structured, with nothing missing for the reviewer to chase. Once GitHub disables a repository, the change is immediate and public.

Will my name appear publicly when I file a notice?

Yes. GitHub publishes every notice and counter-notice in the public github/dmca repository, redacting only limited contact details. Your name, your URLs, and your legal reasoning are all visible and indexed by search engines. Use a business address rather than a home address, and draft the notice as if a journalist will read it.

Does taking down a repository remove its forks?

Not automatically. Disabling a repository leaves its forks standing unless you identify them and they are separately disabled. If the entire network is infringing, say so in your notice and GitHub can disable it network-wide. If only some files are infringing, spot-check each fork before naming it, since a fork may have deleted the flagged material.

Can I file if my code was released under an open-source license?

Sometimes. An open-source license is permission, so compliant copying is not infringement. You have a claim when the copier violated the terms: removed copyright or license text, relicensed your code under their own name, skipped required attribution, or shipped GPL-covered code in a closed-source product. If the use complies, a DMCA notice is the wrong tool.

What happens if I ignore a counter-notice?

The clock runs out. Under 17 U.S.C. § 512(g), you have 10 to 14 business days from the counter-notice to file a court action seeking to restrain the infringement. If you do nothing, GitHub restores the content. Since US works generally must be registered before you can sue, that decision point can arrive faster than you expect.

What to do today

If you are filing today, the short version of everything above:

  1. Reread your license and name the specific violation: stripped notice, bad relicense, GPL noncompliance, or wholesale copying.
  2. Clone the repository and archive the commit history while it is still live.
  3. List the forks worth reporting and verify each still contains the material.
  4. File through the DMCA form with a narrow, professional notice and a business address.
  5. Decide now how you would answer a counter-notice; the window is short and a US court action requires registration first.

If this is one repository, the checklist is enough. If the same code keeps respawning across code hosts, file lockers, and marketplaces, our managed takedown service handles all of it in one case, and you can review pricing before committing.