A GitHub transfer moves history, issues, pull requests and the wiki, and keeps webhooks, secrets and deploy keys associated. That is exactly why you must rotate credentials afterward. Anything the agency created still works until revoked. Also update local clones and check Pages and custom domain settings.
What the documentation says moves
GitHub's guide on transferring a repository lists what carries over.
- Issues, pull requests, wiki, stars and watchers.
- Webhooks, services, secrets and deploy keys, which "will remain associated after the transfer is complete."
- Git history, commit contributions and Git LFS objects.
- Forks stay linked.
- Actions secrets carry over.
What needs attention
- Local clones. Update the remote URL on every agency machine, or better, delete the clones.
- GitHub Pages. Repository links redirect, but Pages sites are not redirected. If a custom domain is in use, review DNS before the move to avoid domain takeover risk.
- Collaborators. The original owner becomes a collaborator. Remove them.
- Features by plan. Moving a private repo to a free account can remove features such as protected branches and Pages.
- Packages. They may lose their repository link depending on the registry.
- Retired names. In some cases, such as repositories with many clones or Actions uses, the old owner and name combination is retired permanently.
The rotation list
Because secrets and deploy keys stay attached, treat the transfer as the start of cleanup rather than the end.
| Item | Action |
|---|---|
| Actions secrets | Reissue under client-owned credentials, then update |
| Deploy keys | Replace with client-generated keys |
| Webhooks | Review each endpoint, remove agency ones |
| Personal access tokens | Revoke any agency staff tokens used by CI |
| Registry tokens | Replace as in the private registry post |
| Hosting and DNS access | Confirm client ownership |
| Collaborators and teams | Remove agency accounts that no longer need access |
Order of operations
- Agree a window. Freeze merges.
- Run a final dependency audit and export an SBOM.
- Transfer the repository.
- Client creates new secrets and deploy keys.
- Run a full build and deploy from the client's side.
- Agency revokes old credentials.
- Both sides record the date and what was rotated.
Step 5 before step 6 avoids an outage. Step 6 must not be skipped. Credentials that stay alive after the relationship ends are a classic source of incidents.
Keep a record
A short note in the handover pack is enough: date, who transferred, what was rotated, what remains agency owned (for example, a shared design tool), and who to contact. See what an agency should hand over for the wider pack.
Quick check
Should the agency keep read access afterward?
Only if the client asks and the maintenance agreement says so. Make it a named account with an expiry date.
Do forks and local copies need cleanup?
Yes. Agency staff should delete local clones and personal forks of private client code at the end of the engagement.
Sources
Last reviewed: 19 October 2026.
