Repository Interaction Limits FAQ: Managing Community Brigades
Public code repositories and discussion hubs frequently face sudden coordinated influxes of hostile feedback, comment flooding, or spam waves. When external controversies spill over into an open project, community leaders need immediate ways to maintain order without permanently closing their collaboration spaces. This FAQ covers how temporary interaction boundaries and submission ceilings work to cool down heated repositories.
Who has authority to enable interaction restrictions on a project?
Interaction limits cannot be toggled by regular contributors or casual observers. Within a repository, people with admin permissions and designated organization moderators hold the ability to configure and enable these moderation safeguards. When brigading targets multiple spaces at once, administrators can also activate interaction limits across all repositories owned by an organization or a personal account. If an account-wide or organization-wide restriction is actively enabled, administrators cannot adjust interaction limits for individual repositories owned under that umbrella.
What actions are stopped when an interaction limit is active?
Enacting an interaction limit applies a comprehensive freeze on specific participation activities for restricted groups. According to the GitHub Docs on limiting interactions in your repository, the safeguard prevents affected accounts from:
- Posting new comments on existing discussions.
- Opening new issues.
- Submitting new pull requests.
- Adding emoji reactions to posts and comments.
- Editing existing comments they previously posted.
- Editing the titles of issues and pull requests.
Pausing these specific entry points stops bad actors from vandalizing thread titles or burying triage queues in emoji spam while community teams review ongoing disputes. Pair these measures with our broader Forum Moderation Guide for New Community Owners to keep communications constructive during conflicts.
Which restriction tiers and durations can administrators choose?
Community administrators can choose between three distinct interaction limit tiers depending on the source of the disruption:
- Limit to existing users: Restricts participants holding accounts less than 24 hours old who have no prior contributions and lack collaborator status. This directly combats disposable burner accounts created during active harassment waves.
- Limit to prior contributors: Restricts anyone who has not previously contributed to the repository's default branch and does not have collaborator permissions, filtering out outsiders who arrived solely to participate in an off-topic dispute.
- Limit to repository collaborators: Restricts all participants who do not possess write access to the repository, locking contributions down strictly to the direct team.
Whenever an interaction limit is applied, administrators select a defined operating duration: 24 hours, 3 days, 1 week, 1 month, or 6 months. When the selected timeframe expires, normal permissions resume automatically without requiring manual intervention.
How do concurrent pull request limits prevent review queue exhaustion?
Brigades and automated floods do not always limit themselves to comments; bad actors can also generate mass pull requests that clog continuous integration runs and overwhelm volunteer code reviewers. In a public repository, administrators can define a maximum number of concurrent open pull requests allowed per user without write access. A contributor who reaches that cap must wait until an existing pull request is closed or merged before they can submit another.
Maintainers can also configure whether draft pull requests count toward that ceiling by toggling the option to count draft pull requests toward the limit. For projects hosted under an organization, repository-level pull request limit settings explicitly override organization-wide rules, giving repository managers granular control over local contribution flow.
How do automated exemptions and bypass lists protect trusted contributors?
Strict caps can inadvertently inconvenience reliable external contributors who do not need full administrative credentials. To maintain healthy project velocity, administrators can implement automatic exemptions based on two criteria:
- Account age: Exempting contributors whose accounts meet or exceed a specified minimum age in days.
- Merged pull requests: Exempting contributors who have had at least a specified minimum number of pull requests merged into the repository.
A contributor is exempt if they satisfy at least one enabled rule; they do not need to meet both criteria simultaneously. Furthermore, administrators can manually populate a trusted contributor bypass list containing up to 100 users via the user interface or API. This bypass allows regular external collaborators to submit multiple pull requests beyond the active cap without granting them elevated write permissions. Managing these boundaries carefully mirrors standard advice found in our Forum Admin Security: 10 Steps to Protect Your Forum From Takeovers.
How do maintainers navigate to these settings?
Configuring interaction safeguards takes only a few steps through the project interface as detailed in the GitHub Docs on limiting interactions in your repository:
- Navigate to the main page of the target repository.
- Click the Settings tab beneath the repository name (or expand the dropdown menu if the tab is hidden).
- Select Moderation options within the sidebar navigation, then click Interaction limits.
- Locate the desired restriction under Temporary interaction limits, choose the duration from the enable dropdown, or adjust the Pull request limits and exemption list below.
Sources
Published October 30, 2026. No affiliate links on this page. Facts come from the sources linked above; check them for updates.