# GitHub: Unauthenticated LFS requests for public repos are returning unexpected 401 errors

> GitHub status incident “Unauthenticated LFS requests for public repos are returning unexpected 401 errors” on 2025-09-16: impact minor (vendor’s label), 35 min, 1 update(s). Archived by Rewindex.

Canonical: https://rewindex.com/company/github/incidents/nh22ywy9dh84
Last updated: 2025-09-16T18:30:00Z

- Impact (vendor’s label): minor
- Status: resolved
- Started: 2025-09-16 17:55 UTC · Resolved: 2025-09-16 18:30 UTC · Duration: 35 min
- Updates: 1
- [Vendor status page: https://www.githubstatus.com/incidents/nh22ywy9dh84](https://www.githubstatus.com/incidents/nh22ywy9dh84)
- [Company: GitHub](https://rewindex.com/company/github.md)

## Timeline of updates

- **resolved** 2025-09-16 18:30 UTC: Between 16:26 UTC on September 15th and 18:30 UTC on September 16th, anonymous REST API calls to approximately 20 endpoints were incorrectly rejected because they were not authenticated. While this caused unauthenticated requests to be rejected by these endpoints, all authenticated requests were unaffected, and no protected endpoints were exposed. This resulted in 100% of requests to these endpoints failing at peak, representing less than 0.1% of GitHub’s overall request volume. On average, the error rate for these endpoints was less than 50% and peaked at 100% for about 26 hours over September 16th. API requests to the impacted endpoints were rejected with a 401 error code. This was due to a mismatch in authentication policies, for specific endpoints, during a system migration. The failure to detect the errors was the result of the issue occurring for a low percentage of traffic. We mitigated the incident by reverting the policy in question, and correcting the logic associated with the degraded endpoints. We are working to improve our test suite to further validate mismatches, and refining our monitors for proactive detection.

_From the vendor’s published history: only the final update text is available for incidents before Rewindex began polling this page._

## Cite this

Status incident (vendor impact label: minor) posted by GitHub, started 2025-09-16 17:55 UTC, resolved after 35 min, 1 update(s).

- Canonical URL: https://rewindex.com/company/github/incidents/nh22ywy9dh84
- Citation: GitHub, “Unauthenticated LFS requests for public repos are returning unexpected 401 errors” (2025-09-16 17:55 UTC). Archived by Rewindex: https://rewindex.com/company/github/incidents/nh22ywy9dh84 (CC BY 4.0).
- Markdown link: `[GitHub: Unauthenticated LFS requests for public repos are returning unexpected 401 errors (2025-09-16)](https://rewindex.com/company/github/incidents/nh22ywy9dh84)`


---
Canonical: https://rewindex.com/company/github/incidents/nh22ywy9dh84 · Markdown: https://rewindex.com/company/github/incidents/nh22ywy9dh84.md · JSON: https://rewindex.com/api/v1/companies/github/incidents/nh22ywy9dh84 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T13:16:26.798Z