# JuliaHub notification spam?

**URL:** <https://discourse.julialang.org/t/juliahub-notification-spam/112770>\
**Category:** Community\
**Tags:** juliahub\
**Created:** [April 10, 2024, 1:48pm UTC](https://discourse.julialang.org/t/juliahub-notification-spam/112770 "2024-04-10T13:48:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nsajko](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/nsajko/32/221187_2.png) [@nsajko](https://discourse.julialang.org/u/nsajko)\
**Post date:** [April 10, 2024, 1:48pm UTC](https://discourse.julialang.org/t/juliahub-notification-spam/112770/1 "2024-04-10T13:48:20Z")

</div>

I have two notifications on JuliaHub that don’t seem to relate to me at all. Both are from 7 Apr 2024. They look like this (SOME\_USER and SOME\_OTHER\_USER are named something else in actuality):

> ‘SOME\_USER+112’s project’ project’s permissions were updated; [SOME\_OTHER\_USER@gmail.com](mailto:SOME_OTHER_USER@gmail.com) got Editor access. Click here to review permissions.
> 
> ‘SOME\_USER+112’s project’ project’s permissions were updated; [SOME\_OTHER\_USER@gmail.com](mailto:SOME_OTHER_USER@gmail.com) got Reader access. Click here to review permissions.

Clicking on either notification leads to the project (SOME\_USER+112’s project), which seems to be owned by SOME\_USER+111.

I guess this is some kind of bug?

---

<div class="post-metadata">

**Author:** ![nsajko](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/nsajko/32/221187_2.png) [@nsajko](https://discourse.julialang.org/u/nsajko)\
**Post date:** [August 9, 2024, 2:06pm UTC](https://discourse.julialang.org/t/juliahub-notification-spam/112770/2 "2024-08-09T14:06:20Z")

</div>

It happened again yesterday, I got a bunch of notifications that don’t seem to relate to me. Some of them seem to mention @carstenbauer. @mbauman would you be interested in a screenshot or something? This seems like it may be some kind of JuliaHub bug/information leak/hack?

---

<div class="post-metadata">

**Author:** ![mbauman](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mbauman/32/31082_2.png) [@mbauman](https://discourse.julialang.org/u/mbauman)\
**Post date:** [August 9, 2024, 3:08pm UTC](https://discourse.julialang.org/t/juliahub-notification-spam/112770/3 "2024-08-09T15:08:50Z")

</div>

These are notifications from a security bounty program and a JuliaHub security engineer. It’s something we’re actively tracking and working on — and hope to improve!