# Track 02 -- Tools (Tool Map)

> GitHub Account Reinstatement: tools, platforms, and services used when handling GitHub account suspension, appeal, data backup, migration, sanctions compliance, account security, and legal support.

## Source Manifest

| source_id | url | bucket | last_checked | author/host | one-line note |
|-----------|-----|--------|--------------|-------------|---------------|
| T02-S001 | https://support.github.com/contact/reinstatement | surrogate_primary | 2026-05-23 | GitHub / support.github.com | vendor docs (GitHub 一手) -- reinstatement appeal form |
| T02-S002 | https://support.github.com/contact/cannot_sign_in | surrogate_primary | 2026-05-23 | GitHub / support.github.com | vendor docs (GitHub 一手) -- contact form for locked-out users |
| T02-S003 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-appeal-and-reinstatement | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- appeal & reinstatement policy |
| T02-S004 | https://github.com/orgs/community/discussions | surrogate_primary | 2026-05-23 | GitHub / github.com | vendor docs (GitHub 一手) -- community forum for suspension threads |
| T02-S005 | https://docs.github.com/en/repositories/archiving-a-github-repository/backing-up-a-repository | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- official backup guide |
| T02-S006 | https://github.com/cli/cli | surrogate_primary | 2026-05-23 | GitHub / github.com | vendor docs (GitHub 一手) -- GitHub CLI official repo |
| T02-S007 | https://docs.github.com/en/rest/migrations/orgs | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- Migration API endpoints |
| T02-S008 | https://github.com/gabrie30/ghorg | surrogate_primary | 2026-05-23 | gabrie30 / github.com | vendor docs -- ghorg bulk repo cloner |
| T02-S009 | https://github.com/clockfort/GitHub-Backup | surrogate_primary | 2026-05-23 | clockfort / github.com | vendor docs -- GitHub-Backup Python tool |
| T02-S010 | https://www.softwareheritage.org/ | surrogate_primary | 2026-05-23 | Software Heritage / Inria | vendor docs (协会) -- universal source code archive |
| T02-S011 | https://archive.softwareheritage.org/ | surrogate_primary | 2026-05-23 | Software Heritage / Inria | vendor docs (协会) -- archive search interface |
| T02-S012 | https://about.gitlab.com/ | surrogate_primary | 2026-05-23 | GitLab Inc. / gitlab.com | vendor docs (供应商) -- GitLab platform |
| T02-S013 | https://forgejo.org/ | surrogate_primary | 2026-05-23 | Forgejo / Codeberg e.V. | vendor docs (供应商) -- Forgejo community fork of Gitea |
| T02-S014 | https://forgejo.org/compare/ | surrogate_primary | 2026-05-23 | Forgejo / Codeberg e.V. | vendor docs (供应商) -- forge comparison page |
| T02-S015 | https://codeberg.org/ | surrogate_primary | 2026-05-23 | Codeberg e.V. / codeberg.org | vendor docs (供应商) -- non-profit Forgejo host |
| T02-S016 | https://gitea.io/ | surrogate_primary | 2026-05-23 | Gitea Ltd. / gitea.io | vendor docs (供应商) -- Gitea self-hosted forge |
| T02-S017 | https://gitee.com/ | surrogate_primary | 2026-05-23 | OSCHINA / gitee.com | vendor docs (供应商) -- Chinese GitHub alternative |
| T02-S018 | https://jihulab.com/ | surrogate_primary | 2026-05-23 | JiHu (极狐) / jihulab.com | vendor docs (供应商) -- GitLab China entity |
| T02-S019 | https://sourcehut.org/ | surrogate_primary | 2026-05-23 | Drew DeVault / sourcehut.org | vendor docs (供应商) -- minimalist hacker's forge |
| T02-S020 | https://radicle.dev/ | surrogate_primary | 2026-05-23 | Radicle / radicle.dev | vendor docs (供应商) -- P2P decentralized forge |
| T02-S021 | https://bitbucket.org/ | surrogate_primary | 2026-05-23 | Atlassian / bitbucket.org | vendor docs (供应商) -- Bitbucket cloud |
| T02-S022 | https://sanctionssearch.ofac.treas.gov/ | verified_primary | 2026-05-23 | U.S. Treasury OFAC / ofac.treasury.gov | OFAC SDN List Search tool |
| T02-S023 | https://ofac.treasury.gov/sanctions-list-search-tool | verified_primary | 2026-05-23 | U.S. Treasury OFAC / ofac.treasury.gov | SDN search tool landing page |
| T02-S024 | https://www.trade.gov/consolidated-screening-list | verified_primary | 2026-05-23 | International Trade Administration / trade.gov | Consolidated Screening List (CSL) |
| T02-S025 | https://www.trade.gov/data-visualization/csl-search | verified_primary | 2026-05-23 | International Trade Administration / trade.gov | CSL online search tool |
| T02-S026 | https://www.bis.gov/entity-list | verified_primary | 2026-05-23 | Bureau of Industry & Security / bis.gov | BIS Entity List |
| T02-S027 | https://www.opensanctions.org/ | surrogate_primary | 2026-05-23 | OpenSanctions / opensanctions.org | vendor docs -- open-source sanctions database |
| T02-S028 | https://github.com/opensanctions/opensanctions | surrogate_primary | 2026-05-23 | OpenSanctions / github.com | vendor docs -- OpenSanctions source code |
| T02-S029 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- 2FA configuration guide |
| T02-S030 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- 2FA recovery methods |
| T02-S031 | https://docs.github.com/en/authentication/authenticating-with-a-passkey/managing-your-passkeys | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- passkey management |
| T02-S032 | https://www.yubico.com/works-with-yubikey/catalog/github/ | surrogate_primary | 2026-05-23 | Yubico / yubico.com | vendor docs (供应商) -- YubiKey + GitHub integration |
| T02-S033 | https://www.ferrariassociatespc.com/ | surrogate_primary | 2026-05-23 | Ferrari & Associates / ferrariassociatespc.com | vendor docs (律所) -- OFAC sanctions specialists |
| T02-S034 | https://sanctionlaw.com/ | surrogate_primary | 2026-05-23 | Erich Ferrari / sanctionlaw.com | vendor docs (作者一手) -- OFAC sanctions law blog |
| T02-S035 | https://www.gibsondunn.com/practice/sanctions-and-export-enforcement/ | surrogate_primary | 2026-05-23 | Gibson Dunn / gibsondunn.com | vendor docs (律所) -- sanctions & export enforcement practice |
| T02-S036 | https://www.hoganlovells.com/en/aof/sanctions | surrogate_primary | 2026-05-23 | Hogan Lovells / hoganlovells.com | vendor docs (律所) -- sanctions practice |
| T02-S037 | https://www.eff.org/issues/dmca | surrogate_primary | 2026-05-23 | EFF / eff.org | vendor docs (协会) -- DMCA resources and legal help |
| T02-S038 | https://www.eff.org/document/dmca-counter-notice | surrogate_primary | 2026-05-23 | EFF / eff.org | vendor docs (协会) -- DMCA counter-notice template |
| T02-S039 | https://sfconservancy.org/copyleft-compliance/ | surrogate_primary | 2026-05-23 | Software Freedom Conservancy / sfconservancy.org | vendor docs (协会) -- copyleft compliance & GPL enforcement |
| T02-S040 | https://lumendatabase.org/ | surrogate_primary | 2026-05-23 | Berkman Klein Center, Harvard / lumendatabase.org | vendor docs (协会) -- DMCA takedown transparency database |
| T02-S041 | https://github.com/github/gov-takedowns | surrogate_primary | 2026-05-23 | GitHub / github.com | vendor docs (GitHub 一手) -- government takedown notices repo |
| T02-S042 | https://github.com/github/dmca | surrogate_primary | 2026-05-23 | GitHub / github.com | vendor docs (GitHub 一手) -- DMCA takedown notices repo |
| T02-S043 | https://docs.github.com/en/site-policy/other-site-policies/github-and-trade-controls | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- trade controls page |
| T02-S044 | https://github.com/mattduck/gh2md | surrogate_primary | 2026-05-23 | mattduck / github.com | vendor docs -- gh2md issues/PRs export tool |
| T02-S045 | https://sanctionslist.ofac.treas.gov/ | verified_primary | 2026-05-23 | U.S. Treasury OFAC / ofac.treasury.gov | OFAC Sanctions List Service (downloadable data) |
| T02-S046 | https://cli.github.com/ | surrogate_primary | 2026-05-23 | GitHub / cli.github.com | vendor docs (GitHub 一手) -- GitHub CLI home page |
| T02-S047 | https://github.com/SierraSoftworks/github-backup | surrogate_primary | 2026-05-23 | Sierra Softworks / github.com | vendor docs -- automated GitHub backup tool |
| T02-S048 | https://docs.github.com/en/migrations | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) -- migrations documentation hub |

---

## Overview by Category

| # | Tool | Category | Free? | Key Use Case |
|---|------|----------|-------|-------------|
| 1 | GitHub Reinstatement Form | Appeal | Yes | Primary appeal channel for suspended accounts |
| 2 | GitHub "Cannot Sign In" Form | Appeal | Yes | Contact support when locked out of account |
| 3 | GitHub Community Discussions | Appeal | Yes | Public escalation & peer advice |
| 4 | Twitter/X @github @githubsupport | Appeal | Yes | Public escalation when tickets stall |
| 5 | `git clone --mirror` | Backup | Yes | Full repo backup including all refs |
| 6 | GitHub CLI (`gh`) | Backup | Yes | Export issues, PRs, discussions via API |
| 7 | gh2md | Backup | Yes | Export issues/PRs to markdown files |
| 8 | ghorg | Backup | Yes | Bulk clone all repos in org/user |
| 9 | GitHub-Backup (clockfort) | Backup | Yes | Automated user/org full backup |
| 10 | github-backup (Sierra Softworks) | Backup | Yes | Scheduled multi-org backup |
| 11 | GitHub Migration API | Backup | Yes | Official org migration archive export |
| 12 | Software Heritage | Backup | Yes | Independent code archive (26B+ files) |
| 13 | GitLab | Alternative | Freemium | Full-featured CI/CD-native platform |
| 14 | Forgejo | Alternative | Yes | Lightweight community-governed forge |
| 15 | Codeberg | Alternative | Yes | Non-profit hosted Forgejo instance |
| 16 | Gitea | Alternative | Yes | Lightweight self-hosted forge |
| 17 | Gitee | Alternative | Freemium | Chinese government-backed GitHub alternative |
| 18 | JihuLab (极狐) | Alternative | Freemium | GitLab China localized entity |
| 19 | Bitbucket | Alternative | Freemium | Atlassian ecosystem integration |
| 20 | SourceHut (sr.ht) | Alternative | Paid | Minimalist email-driven hacker's forge |
| 21 | Radicle | Alternative | Yes | P2P censorship-resistant decentralized forge |
| 22 | OFAC SDN List Search | Compliance | Yes | Check if you are on the sanctions blocklist |
| 23 | Consolidated Screening List (CSL) | Compliance | Yes | Cross-agency U.S. restricted party search |
| 24 | BIS Entity List | Compliance | Yes | Export control restricted entities |
| 25 | OpenSanctions | Compliance | Free/Paid | Open-source global sanctions database |
| 26 | Lumen Database | Compliance | Yes | DMCA takedown transparency research |
| 27 | TOTP Authenticator Apps | Security | Yes | Standard 2FA for GitHub |
| 28 | YubiKey / Hardware Security Keys | Security | Paid | FIDO2/WebAuthn hardware 2FA |
| 29 | GitHub Passkeys | Security | Yes | Passwordless + 2FA in one credential |
| 30 | Recovery Codes | Security | Yes | Emergency 2FA backup |
| 31 | Ferrari & Associates | Legal | Paid | OFAC delisting and sanctions licensing |
| 32 | Gibson Dunn | Legal | Paid | Large-firm sanctions & export enforcement |
| 33 | Hogan Lovells | Legal | Paid | Global sanctions & trade controls |
| 34 | EFF | Legal | Free | DMCA counter-notice guidance & templates |
| 35 | Software Freedom Conservancy | Legal | Free | GPL enforcement & copyleft compliance |

---

## Category 1: Appeal & Communication Tools

These are the tools for direct interaction with GitHub when your account is suspended or restricted. They form the front line of any reinstatement effort.

### 1. GitHub Reinstatement Form

- **Category**: Appeal
- **One-liner**: The only official channel to appeal a GitHub account suspension or request reinstatement
- **URL**: https://support.github.com/contact/reinstatement
- **Open source?**: No (proprietary GitHub infrastructure)
- **Pricing**: Free
- **When to use**: Immediately after account suspension notification. Must be filed within 6 months of the enforcement action. This is always Step 1 -- no other appeal channel bypasses this form. evidence: [T02-S001] [T02-S003]
- **Pros**: Official and only sanctioned pathway; reviewed by GitHub Trust & Safety team; clearly documented process with defined response expectations
- **Cons**: Response time varies (days to weeks); no phone support; requires sending from the email address associated with the suspended account; opaque decision criteria; no guaranteed timeline
- **Industry consensus**: The reinstatement form is non-negotiable -- every practitioner agrees this is the mandatory first step. Skipping it or trying to work around it (e.g., creating a new account) is the single biggest mistake and constitutes "ban evasion" which leads to permanent suspension. evidence: [T02-S001] [T02-S003]

### 2. GitHub "Cannot Sign In" Form

- **Category**: Appeal
- **One-liner**: Contact GitHub Support when you cannot log into your account (required for suspended users who cannot access regular support)
- **URL**: https://support.github.com/contact/cannot_sign_in
- **Open source?**: No
- **Pricing**: Free
- **When to use**: When your account is suspended and you literally cannot sign in to use the regular support portal. This form does not require authentication -- you verify via the email on the account. evidence: [T02-S002]
- **Pros**: No login required; email verification instead of authentication; specifically designed for locked-out users
- **Cons**: Same response-time uncertainty as the reinstatement form; limited categories available
- **Industry consensus**: Essential complement to the reinstatement form. Many suspended users do not realize this form exists and waste time trying to find a way to log in to file a support ticket. evidence: [T02-S002]

### 3. GitHub Community Discussions

- **Category**: Appeal (indirect)
- **One-liner**: Public forum where users share suspension experiences and sometimes get noticed by GitHub staff
- **URL**: https://github.com/orgs/community/discussions
- **Open source?**: No
- **Pricing**: Free
- **When to use**: After filing the reinstatement form, if you need peer advice on how others handled similar situations, or as a secondary escalation channel when your ticket seems stalled. evidence: [T02-S004]
- **Pros**: Public visibility can sometimes accelerate response; large library of resolved cases to learn from; GitHub staff do occasionally respond; no login to the suspended account required (can post from any account)
- **Cons**: No SLA; public exposure of your situation; GitHub staff response is discretionary not guaranteed; new-account posting may be restricted
- **Industry consensus**: Useful for intelligence gathering (what worked for others) but unreliable as a primary escalation path. The reinstatement form remains the authoritative channel. evidence: [T02-S004]

### 4. Twitter/X @github @githubsupport

- **Category**: Appeal (escalation)
- **One-liner**: Public social media escalation when formal support channels are unresponsive
- **URL**: https://twitter.com/github / https://twitter.com/githubsupport
- **Open source?**: N/A
- **Pricing**: Free
- **When to use**: After exhausting the reinstatement form and waiting a reasonable period (2+ weeks with no response). A polite public tweet documenting your timeline can sometimes accelerate review.
- **Pros**: Public pressure can break through support queue stalls; GitHub's social media team monitors mentions
- **Cons**: No guarantee of response; risks being ignored or receiving a templated redirect to the support form; publicly exposing your situation; not a substitute for the formal form
- **Industry consensus**: A last-resort escalation tactic. Effective in some documented cases (especially when accompanied by a clear, professional timeline of the support interaction) but should never replace the formal reinstatement form.

---

## Category 2: Data Backup & Export Tools

These tools protect your code and metadata before, during, or after a suspension event. The cardinal rule: back up proactively, before you need it.

### 5. `git clone --mirror`

- **Category**: Backup
- **One-liner**: Full bare-repository clone including all branches, tags, refs, and commit history
- **URL**: Built-in Git command; docs at https://git-scm.com/docs/git-clone
- **Open source?**: Yes (GPL-2.0)
- **Pricing**: Free
- **When to use**: First line of defense for any repo you care about. Run regularly as a cron job. For repos with LFS objects, follow with `git lfs fetch --all`. evidence: [T02-S005]
- **Pros**: Captures complete git history; works offline; no dependencies beyond git; industry standard; can be pushed to any other git remote
- **Cons**: Does not capture issues, PRs, discussions, wiki (separate git repo), project boards, or GitHub-specific metadata; LFS objects require extra step; suspended accounts may have clone access blocked
- **Industry consensus**: The absolute minimum backup every developer should have. If you have nothing else, at least have `--mirror` clones of your important repos on a local drive or secondary remote. evidence: [T02-S005]

### 6. GitHub CLI (`gh`)

- **Category**: Backup
- **One-liner**: GitHub's official CLI tool; particularly useful for exporting non-git metadata (issues, PRs, discussions) via `gh api`
- **URL**: https://cli.github.com/ / https://github.com/cli/cli
- **Open source?**: Yes (MIT)
- **Pricing**: Free
- **When to use**: To export issues, pull requests, discussions, and other GitHub-specific data that `git clone` does not capture. Combine `gh api --paginate` with `--jq` for structured JSON export. evidence: [T02-S006] [T02-S046]
- **Pros**: Official tool with built-in auth; supports pagination and JSON output; scriptable; single binary; works with GitHub Enterprise too
- **Cons**: Requires authentication (PAT or OAuth) -- suspended accounts may lose API access; does not handle LFS or repo content (use git for that); rate-limited by GitHub API
- **Industry consensus**: The go-to tool for metadata export. Practitioners recommend scripting `gh api` calls to dump issues, PRs, and comments into local JSON files as part of a regular backup routine. evidence: [T02-S006] [T02-S046]

### 7. gh2md

- **Category**: Backup
- **One-liner**: Export GitHub issues and pull requests (with comments) to readable markdown files
- **URL**: https://github.com/mattduck/gh2md
- **Open source?**: Yes (MIT)
- **Pricing**: Free
- **When to use**: When you want human-readable exports of issue and PR discussions, not just raw JSON. Useful for archiving project knowledge that lives in GitHub issues. evidence: [T02-S044]
- **Pros**: Produces clean markdown output; includes comments; works with GitHub Enterprise
- **Cons**: Does not export discussions or project boards; requires PAT for private repos
- **Industry consensus**: Nice complement to `gh api` for archival purposes. Produces output you can actually read and search through without tooling. evidence: [T02-S044]

### 8. ghorg

- **Category**: Backup
- **One-liner**: Bulk clone all repos from an organization or user account into a single directory
- **URL**: https://github.com/gabrie30/ghorg
- **Open source?**: Yes (Apache-2.0)
- **Pricing**: Free
- **When to use**: When you need to back up an entire organization or user's repos at once, not just one repo at a time. Supports GitHub, GitLab, Bitbucket. evidence: [T02-S008]
- **Pros**: Supports multiple platforms (GitHub/GitLab/Bitbucket); flexible filtering (by topic, language, etc.); supports mirror clones; Go single binary
- **Cons**: Does not export metadata (issues, PRs, etc.); requires PAT; may hit rate limits on large orgs
- **Industry consensus**: The standard tool for "clone everything" scenarios. Especially valuable for organizations with hundreds of repos where manual cloning is impractical. evidence: [T02-S008]

### 9. GitHub-Backup (clockfort)

- **Category**: Backup
- **One-liner**: Python script that automatically backs up all repos for a GitHub user or organization
- **URL**: https://github.com/clockfort/GitHub-Backup
- **Open source?**: Yes (BSD)
- **Pricing**: Free
- **When to use**: Automated backup scheduling for users who want a simple cron-based solution. evidence: [T02-S009]
- **Pros**: Simple Python script; easy to cron; backs up all repos including private (with PAT)
- **Cons**: Python dependency; less actively maintained than ghorg; no metadata export
- **Industry consensus**: A viable lightweight option for personal use. For organizations, ghorg or the Sierra Softworks variant tend to be preferred. evidence: [T02-S009]

### 10. github-backup (Sierra Softworks)

- **Category**: Backup
- **One-liner**: Designed for scheduled backup processes; clones or fetches all repos from one or more GitHub organizations
- **URL**: https://github.com/SierraSoftworks/github-backup
- **Open source?**: Yes (MIT)
- **Pricing**: Free
- **When to use**: When you need a robust, schedule-friendly backup of multiple organizations. Designed to be idempotent -- clone on first run, fetch on subsequent runs. evidence: [T02-S047]
- **Pros**: Idempotent design; multi-org support; designed for automation; Rust-based (fast)
- **Cons**: No metadata export; focused on git content only
- **Industry consensus**: Good choice for automated infrastructure-level backup. The idempotent design means it fits naturally into cron jobs or CI pipelines. evidence: [T02-S047]

### 11. GitHub Migration API

- **Category**: Backup
- **One-liner**: Official REST API for generating migration archives of repositories with selected metadata
- **URL**: https://docs.github.com/en/rest/migrations/orgs / https://docs.github.com/en/migrations
- **Open source?**: No (GitHub proprietary API)
- **Pricing**: Free (for org owners)
- **When to use**: When you need an official export that includes some metadata beyond just git content. Primarily designed for GitHub-to-GitHub-Enterprise migrations but usable for archival. evidence: [T02-S007] [T02-S048]
- **Pros**: Official GitHub API; includes some metadata (issues, PRs) not just git content; generates downloadable archive
- **Cons**: Only available to org owners; archives auto-delete after 7 days; does not include LFS objects, discussions, or packages; the archive format is not documented for import into non-GitHub systems; "there is no supported, documented way to restore migration archives on GitHub" (per official docs) -- archival only; requires org-level PAT with `admin:org` scope
- **Industry consensus**: Useful as a supplementary backup channel but has significant gaps. The lack of a documented restore path means this is for archival, not disaster recovery. evidence: [T02-S007] [T02-S048]

### 12. Software Heritage

- **Category**: Backup (independent archive)
- **One-liner**: Universal source code archive run by Inria; has already archived 26B+ unique source files from 400M+ repos
- **URL**: https://www.softwareheritage.org/ / https://archive.softwareheritage.org/
- **Open source?**: Yes (infrastructure is open source)
- **Pricing**: Free
- **When to use**: As a last-resort recovery source. If your GitHub repo was public before suspension, Software Heritage may have already archived it. You can search the archive at archive.softwareheritage.org. Also useful as a proactive archival strategy -- you can trigger an archive of any public repo via the "Save code now" feature. evidence: [T02-S010] [T02-S011]
- **Pros**: Independent of GitHub; massive archive; preserves development history; academic/institutional backing (Inria, UNESCO); free API access; SWHID persistent identifiers for exact code versions
- **Cons**: Only archives public repos; may not have the latest version; no metadata (issues, PRs); cannot be used as a live development platform
- **Industry consensus**: An essential safety net for open-source developers. Not a replacement for active backups but invaluable when everything else fails. If your public repo was on GitHub before suspension, check Software Heritage first. evidence: [T02-S010] [T02-S011]

---

## Category 3: Alternative Platforms

Where to go when GitHub is not available. Migration targets are ranked by relevance to the suspension/reinstatement scenario.

### 13. GitLab (gitlab.com + self-hosted CE/EE)

- **Category**: Alternative Platform
- **One-liner**: Full-featured DevOps platform with built-in CI/CD; the most common GitHub migration target for teams and enterprises
- **URL**: https://about.gitlab.com/ / https://gitlab.com/
- **Open source?**: Yes (CE under MIT license; EE proprietary add-ons)
- **Pricing**: Free tier (5 users, 5GB storage, 400 CI minutes/month); Premium $29/user/mo; Ultimate $99/user/mo
- **When to use**: When you need a full-featured replacement with CI/CD, container registry, issue boards, and project management -- especially for teams or enterprises. GitLab has built-in GitHub import tools. evidence: [T02-S012]
- **Pros**: Most feature-complete GitHub alternative; built-in CI/CD; self-hosting option (CE); strong migration tools from GitHub; large ecosystem; enterprise-grade
- **Cons**: Resource-heavy (8GB+ RAM for self-hosted); complex administration for self-hosted; free tier is limited; corporate-controlled (for-profit company)
- **Industry consensus**: The default recommendation for teams migrating from GitHub. Self-hosted CE is popular for organizations needing full control. The primary downside is resource requirements for self-hosting. evidence: [T02-S012]

### 14. Forgejo

- **Category**: Alternative Platform
- **One-liner**: Community-governed, lightweight, self-hosted forge; hard fork of Gitea prioritizing independence from corporate control
- **URL**: https://forgejo.org/
- **Open source?**: Yes (MIT + GPL-3.0)
- **Pricing**: Free
- **When to use**: When you want a lightweight, self-hosted forge that runs on minimal hardware (as low as a Raspberry Pi with 170MB RAM). Ideal for individuals or small teams who value community governance over corporate control. evidence: [T02-S013] [T02-S014]
- **Pros**: Extremely lightweight; democratic governance (Codeberg e.V.); runs on tiny machines; federation roadmap (ForgeFed); single binary; familiar GitHub-like UI
- **Cons**: Smaller ecosystem than GitLab; limited CI/CD (Actions support is early); no built-in project management; smaller community than Gitea
- **Industry consensus**: Emerging as the top recommendation for self-hosted forges in 2025-2026, especially for those who left Gitea over governance concerns. The Forgejo-over-Gitea preference is strengthening. evidence: [T02-S013] [T02-S014]

### 15. Codeberg

- **Category**: Alternative Platform
- **One-liner**: Non-profit hosted Forgejo instance based in Germany; the "just works" option for individuals who do not want to self-host
- **URL**: https://codeberg.org/
- **Open source?**: Yes (infrastructure runs Forgejo)
- **Pricing**: Free (donation-supported)
- **When to use**: When you want a GitHub-like experience without self-hosting and without a corporation. Built-in migration tools from GitHub, GitLab, Gitea, Gogs. evidence: [T02-S015]
- **Pros**: Free; non-profit (Codeberg e.V., Germany); built-in GitHub import; no ads; privacy-focused; stable and growing
- **Cons**: Limited CI/CD (bring your own runner for Actions); smaller community; no enterprise features; may have limited availability guarantees vs. commercial platforms
- **Industry consensus**: The top recommendation for individuals who want to leave GitHub immediately without self-hosting. Increasingly adopted by FOSS projects as primary or mirror host. evidence: [T02-S015]

### 16. Gitea

- **Category**: Alternative Platform
- **One-liner**: Lightweight self-hosted Git service; single binary deployment
- **URL**: https://gitea.io/ (also https://about.gitea.com/)
- **Open source?**: Yes (MIT)
- **Pricing**: Free (self-hosted); Gitea Cloud is freemium
- **When to use**: When you need a lightweight self-hosted forge with minimal setup. Gitea preceded Forgejo and has a larger existing install base. evidence: [T02-S016]
- **Pros**: Single binary; minimal resources; large ecosystem of plugins/themes; familiar GitHub-like UI; mature and battle-tested
- **Cons**: Governance concerns (Gitea Ltd. commercial direction triggered the Forgejo fork); some community trust erosion; Forgejo is increasingly recommended over Gitea
- **Industry consensus**: Still widely used but the governance controversy has shifted recommendations toward Forgejo for new installations. Existing Gitea users generally have no urgency to switch. evidence: [T02-S016]

### 17. Gitee

- **Category**: Alternative Platform
- **One-liner**: China's government-backed GitHub alternative; the default choice for Chinese developers under sanctions-related GitHub access issues
- **URL**: https://gitee.com/
- **Open source?**: No (proprietary platform)
- **Pricing**: Free tier; Enterprise paid plans
- **When to use**: Specifically for Chinese developers who need a domestic platform with local compliance, Chinese-language support, and no U.S. sanctions exposure. evidence: [T02-S017]
- **Pros**: Domestic hosting in China (no GFW issues); government backing (MIIT); Chinese language native; 10M+ projects; import from GitHub available
- **Cons**: Code review/censorship by platform (mandatory for public repos since 2022); limited international reach; government oversight; smaller global community; English support is secondary
- **Industry consensus**: The pragmatic choice for Chinese developers who need a domestic fallback. Not a global GitHub replacement, but essential for the zh-CN audience. The mandatory code review policy is a significant concern for some users. evidence: [T02-S017]

### 18. JihuLab (极狐 GitLab)

- **Category**: Alternative Platform
- **One-liner**: GitLab's official Chinese joint venture; domestically hosted GitLab with local compliance
- **URL**: https://jihulab.com/
- **Open source?**: Based on GitLab CE/EE
- **Pricing**: Freemium (mirrors GitLab pricing tiers)
- **When to use**: For Chinese teams/enterprises that want GitLab's feature set with domestic hosting and compliance. evidence: [T02-S018]
- **Pros**: Full GitLab feature set; domestic hosting; local support in Chinese; enterprise-grade CI/CD
- **Cons**: Depends on GitLab upstream; commercial entity; less community adoption than Gitee for individual use
- **Industry consensus**: Recommended for Chinese enterprise users who need GitLab-class features domestically. Individual users generally prefer Gitee for simplicity. evidence: [T02-S018]

### 19. Bitbucket

- **Category**: Alternative Platform
- **One-liner**: Atlassian's Git hosting platform; strong Jira/Confluence integration
- **URL**: https://bitbucket.org/
- **Open source?**: No (proprietary)
- **Pricing**: Free (up to 5 users); Standard $3/user/mo; Premium $6/user/mo
- **When to use**: When your team is already in the Atlassian ecosystem (Jira, Confluence). Less commonly recommended as a GitHub replacement for open-source projects. evidence: [T02-S021]
- **Pros**: Tight Atlassian integration; Bitbucket Pipelines CI/CD; free for small teams; enterprise features
- **Cons**: Limited free tier; less community/open-source adoption; Atlassian has sunset Mercurial and other features historically; not a natural home for FOSS projects
- **Industry consensus**: A viable option for Atlassian-shop teams but rarely the first recommendation for GitHub migrants. evidence: [T02-S021]

### 20. SourceHut (sr.ht)

- **Category**: Alternative Platform
- **One-liner**: Minimalist, email-driven forge built on Unix philosophy; no JavaScript, no corporate control
- **URL**: https://sourcehut.org/
- **Open source?**: Yes (AGPL-3.0)
- **Pricing**: Paid ($2-$10/mo; currently in alpha with free access)
- **When to use**: For developers comfortable with email-based workflows (git send-email, mailing lists). Ideal for FOSS purists and projects that value longevity and simplicity over web UI polish. evidence: [T02-S019]
- **Pros**: 100% free software; ultra-fast (no JavaScript UI); email-based code review (kernel-style); powerful CI (builds.sr.ht); transparent governance; self-hostable
- **Cons**: Steep learning curve for GitHub-native developers; email-based workflow is unfamiliar to most; smaller community; limited discoverability; no fork/PR model (patches instead)
- **Industry consensus**: A philosophical alternative, not a drop-in replacement. Recommended for experienced developers who actively want to move away from platform-centric workflows. Not for teams expecting GitHub-like UX. evidence: [T02-S019]

### 21. Radicle

- **Category**: Alternative Platform
- **One-liner**: Peer-to-peer, censorship-resistant code collaboration built on Git; no central server
- **URL**: https://radicle.dev/ (formerly radicle.xyz)
- **Open source?**: Yes (MIT + Apache-2.0)
- **Pricing**: Free
- **When to use**: When censorship resistance is a primary concern -- e.g., developers in sanctioned regions who fear platform-level bans. Radicle has no central authority that can suspend accounts. evidence: [T02-S020]
- **Pros**: No central point of failure or control; censorship-resistant by design; cryptographic identity; gossip-based replication; no account to suspend; active development (~8000 repos on public seeds as of 2026)
- **Cons**: Early stage; small ecosystem; no web UI comparable to GitHub; requires running a node; limited tooling; no CI/CD built-in; discoverability is limited
- **Industry consensus**: The most ideologically aligned alternative for the "GitHub banned me" scenario, but practically immature for most teams. Worth watching and potentially using as a censorship-resistant mirror alongside a primary forge. Presented at CCC (38c3 + 39c3) as a serious project. evidence: [T02-S020]

---

## Category 4: Sanctions Compliance & Screening Tools

Tools for determining whether you or your organization are on a sanctions list, and for understanding why GitHub may have flagged your account.

### 22. OFAC SDN List Search

- **Category**: Sanctions Compliance
- **One-liner**: The U.S. Treasury's official tool for searching the Specially Designated Nationals (SDN) blocklist -- the very list GitHub screens against
- **URL**: https://sanctionssearch.ofac.treas.gov/
- **Open source?**: No (U.S. government tool)
- **Pricing**: Free
- **When to use**: When your GitHub suspension mentions trade controls or sanctions. Search your own name, aliases, and any associated entities to determine if you are on the SDN list. The tool uses fuzzy matching on the name field. evidence: [T02-S022] [T02-S023]
- **Pros**: Authoritative source (the actual list GitHub uses); free; fuzzy name matching; updated frequently; includes individuals, entities, vessels, aircraft
- **Cons**: Fuzzy matching can produce false positives; no batch screening capability; does not tell you why GitHub specifically flagged you; U.S.-centric (does not cover EU/UK autonomous sanctions)
- **Industry consensus**: The single most important self-diagnostic tool for sanctions-related suspensions. If you are NOT on this list, your suspension is likely due to IP-based location detection (VPN/proxy issue), not personal designation. This is critical evidence for your appeal. evidence: [T02-S022] [T02-S023]

### 23. Consolidated Screening List (CSL)

- **Category**: Sanctions Compliance
- **One-liner**: A unified search across 12+ U.S. government restricted-party lists from Commerce, State, and Treasury departments
- **URL**: https://www.trade.gov/consolidated-screening-list / https://www.trade.gov/data-visualization/csl-search
- **Open source?**: No (U.S. government tool)
- **Pricing**: Free (also has free API)
- **When to use**: A broader search than OFAC SDN alone. If you want to check all U.S. restricted-party lists (not just Treasury), the CSL aggregates them. Includes BIS Entity List, Denied Persons List, Unverified List, and more. evidence: [T02-S024] [T02-S025]
- **Pros**: Covers multiple agencies in one search; fuzzy name matching; free API for programmatic access; updated daily at 5:00 AM EST
- **Cons**: Still U.S.-only; may return false positives on fuzzy matches; does not include EU/UK sanctions lists
- **Industry consensus**: A good complement to the OFAC SDN search. If you want a single broader check across all U.S. restricted-party lists, the CSL is the tool. evidence: [T02-S024] [T02-S025]

### 24. BIS Entity List

- **Category**: Sanctions Compliance
- **One-liner**: The Bureau of Industry and Security's list of entities subject to export control restrictions
- **URL**: https://www.bis.gov/entity-list
- **Open source?**: No (U.S. government)
- **Pricing**: Free
- **When to use**: When your suspension may be related to export control (EAR) rather than financial sanctions (OFAC). The Entity List targets entities deemed threats to U.S. national security or foreign policy, and since 2024 includes automatic 50%-ownership subsidiary coverage. evidence: [T02-S026]
- **Pros**: Authoritative; searchable; regularly updated; relevant for entities (companies, research institutions) more than individuals
- **Cons**: Primarily targets organizations, not individuals; searching requires knowing the entity name; does not cover OFAC SDN designations
- **Industry consensus**: Less directly relevant to individual developer suspensions but critical for organizational accounts, especially Chinese tech entities. If you work for an Entity-Listed organization, that may explain restricted access. evidence: [T02-S026]

### 25. OpenSanctions

- **Category**: Sanctions Compliance
- **One-liner**: Open-source, cross-jurisdictional sanctions database aggregating 333+ global sources with fuzzy matching
- **URL**: https://www.opensanctions.org/ / https://github.com/opensanctions/opensanctions
- **Open source?**: Yes (MIT for code; data license required for commercial use)
- **Pricing**: Free for non-commercial use; paid data license or API subscription for commercial use
- **When to use**: When you need to check beyond U.S. sanctions (EU, UK, UN, other jurisdictions). Also useful for batch screening and self-hosted screening via the yente API. evidence: [T02-S027] [T02-S028]
- **Pros**: Global coverage (not just U.S.); open-source code; deduplicated and enriched data; API and self-hosted screening options; used by Bellingcat and investigative journalists
- **Cons**: Commercial use requires license; data quality depends on source quality; more complex than a simple web search; some technical setup for self-hosted screening
- **Industry consensus**: The best open-source option for comprehensive sanctions screening. Especially valuable for non-U.S. users who need to check EU autonomous sanctions, UK OFSI list, UN consolidated list, etc. evidence: [T02-S027] [T02-S028]

### 26. Lumen Database

- **Category**: Compliance (DMCA transparency)
- **One-liner**: Harvard-hosted database of DMCA takedown notices; useful for researching whether your content was flagged via DMCA
- **URL**: https://lumendatabase.org/
- **Open source?**: Yes (Ruby on Rails; code on GitHub)
- **Pricing**: Free (researcher API access requires application)
- **When to use**: When your GitHub suspension is related to a DMCA takedown. Search Lumen to find the specific takedown notice, understand the claimant, and inform your counter-notice strategy. evidence: [T02-S040]
- **Pros**: Transparency tool showing exactly what was claimed and by whom; academic backing (Berkman Klein Center); free public search; structured data
- **Cons**: Not all takedown notices are indexed (voluntary submission by platforms); API access is gated; does not help with sanctions-based suspensions; some access restrictions for research data
- **Industry consensus**: Essential research tool for DMCA-related suspensions. Finding the original takedown notice is the first step in crafting an effective counter-notice. evidence: [T02-S040]

### 26b. GitHub gov-takedowns & dmca Repos

- **Category**: Compliance (transparency)
- **One-liner**: GitHub's own public repositories of government takedown notices and DMCA notices
- **URL**: https://github.com/github/gov-takedowns / https://github.com/github/dmca
- **Open source?**: Public repos (license varies)
- **Pricing**: Free
- **When to use**: To see the actual takedown notices GitHub has received and acted on. For DMCA cases, the `dmca` repo includes both takedown and counter-notice records. evidence: [T02-S041] [T02-S042]
- **Pros**: Primary source (directly from GitHub); includes actual notice text; covers both DMCA and government takedowns; git history shows timeline
- **Cons**: Only covers GitHub-actioned notices; no search beyond git/GitHub search; does not cover account suspensions (only content takedowns)
- **Industry consensus**: Required reading if your content was removed via DMCA or government request. The dmca repo is one of the most transparent corporate records in tech. evidence: [T02-S041] [T02-S042]

---

## Category 5: Account Security Tools

Prevention is cheaper than cure. These tools reduce the risk of suspension caused by account compromise, 2FA lockout, or security hygiene failures.

### 27. TOTP Authenticator Apps (Authy, Google Authenticator, 1Password, Bitwarden)

- **Category**: Account Security
- **One-liner**: Time-based one-time password (TOTP) apps providing standard 2FA for GitHub accounts
- **URL**: Various app stores; GitHub docs at https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication
- **Open source?**: Varies (Google Authenticator: proprietary; Bitwarden: open source; Authy: proprietary; 1Password: proprietary)
- **Pricing**: Free (Google Authenticator, Bitwarden free tier); Paid (1Password $3/mo, Bitwarden Premium $1/mo)
- **When to use**: As the baseline 2FA method for every GitHub account. GitHub mandated 2FA for all active contributors since 2024. evidence: [T02-S029]
- **Pros**: Widely supported; easy to set up; works offline; industry standard
- **Cons**: If you lose the device and have no recovery codes, you are locked out (not suspended, but functionally identical); TOTP secrets are not always synced across devices (depends on app); phone-based -- single point of failure
- **Industry consensus**: The minimum security bar. Use a TOTP app (not SMS) as primary 2FA. But always pair with recovery codes and ideally a hardware key. The biggest 2FA-related suspension cause is losing access and then creating a new account (ban evasion). evidence: [T02-S029] [T02-S030]

### 28. YubiKey / Hardware Security Keys (FIDO2/WebAuthn)

- **Category**: Account Security
- **One-liner**: Physical hardware keys providing phishing-resistant 2FA and passkey functionality
- **URL**: https://www.yubico.com/works-with-yubikey/catalog/github/ (YubiKey); also Google Titan Security Key
- **Open source?**: No (proprietary hardware; FIDO2/WebAuthn standards are open)
- **Pricing**: YubiKey 5 series: $25-$75; Google Titan: $30-$35
- **When to use**: As the strongest available 2FA method. Hardware keys cannot be phished (origin-bound), cannot be cloned, and can serve as passkeys for passwordless login. Register on at least two devices in case one is lost. evidence: [T02-S032]
- **Pros**: Phishing-resistant; no battery; no software dependencies; can serve as passkey; works across platforms and services; strongest available 2FA for GitHub
- **Cons**: Physical device that can be lost/damaged; costs money; USB-A/C/NFC compatibility varies; device-bound passkeys cannot be synced; if lost and no other recovery method exists, account recovery is difficult
- **Industry consensus**: The gold standard for GitHub account security. Recommended by GitHub, NIST, and security professionals. Register at least two keys and store recovery codes separately. evidence: [T02-S032]

### 29. GitHub Passkeys

- **Category**: Account Security
- **One-liner**: Passwordless authentication that satisfies both password and 2FA requirements in one credential
- **URL**: https://docs.github.com/en/authentication/authenticating-with-a-passkey/managing-your-passkeys
- **Open source?**: No (GitHub feature; based on open WebAuthn/FIDO2 standards)
- **Pricing**: Free
- **When to use**: As a modern alternative to password + TOTP. Passkeys can be synced (iCloud Keychain, 1Password, etc.) or device-bound (YubiKey). If synced, they survive device loss. evidence: [T02-S031]
- **Pros**: Passwordless; phishing-resistant; satisfies both password and 2FA; synced passkeys survive device loss; simplifies login flow
- **Cons**: Ecosystem still maturing; synced passkey availability depends on OS/browser/password manager; device-bound passkeys cannot be recovered if lost; not all GitHub features support passkey-only auth yet
- **Industry consensus**: The future of GitHub authentication. Synced passkeys (via iCloud Keychain, 1Password, or Google Password Manager) are the recommended path -- they combine convenience with strong security and survive device loss. evidence: [T02-S031]

### 30. Recovery Codes

- **Category**: Account Security
- **One-liner**: One-time backup codes generated by GitHub during 2FA setup; your last resort if all other 2FA methods fail
- **URL**: Generated within GitHub account settings at 2FA configuration time
- **Open source?**: N/A
- **Pricing**: Free
- **When to use**: When you have lost all 2FA devices and need to regain access. Each code is single-use. GitHub strongly recommends storing these in a secure, offline location. evidence: [T02-S030]
- **Pros**: Simple; offline; no dependencies; can be printed and stored in a safe or safety deposit box
- **Cons**: Single-use; if lost and all other 2FA methods are gone, GitHub Support will not restore access to 2FA-enabled accounts; must be stored securely (exposure = compromise)
- **Industry consensus**: "If you do nothing else, save your recovery codes." This is the most commonly cited preventive measure in GitHub suspension/lockout stories. Many users lose access not from suspension but from losing 2FA with no recovery codes. GitHub Support explicitly states they cannot restore access to 2FA-protected accounts. evidence: [T02-S030]

---

## Category 6: Legal & Compliance Services

For cases that go beyond self-service appeal -- sanctions delisting, DMCA disputes, or rights enforcement.

### 31. Ferrari & Associates

- **Category**: Legal
- **One-liner**: Boutique law firm specializing in OFAC sanctions, SDN delisting, and OFAC licensing; led by former OFAC practitioners
- **URL**: https://www.ferrariassociatespc.com/ / Blog: https://sanctionlaw.com/
- **Open source?**: N/A
- **Pricing**: Paid (typical OFAC counsel fees: $10K-$100K+ depending on complexity)
- **When to use**: When your GitHub suspension is due to SDN designation and you need professional legal help to petition OFAC for delisting or obtain a specific license. Also useful for OFAC voluntary self-disclosure if your organization may have unknowingly violated sanctions. evidence: [T02-S033] [T02-S034]
- **Pros**: Deep OFAC specialization; team includes former OFAC officials; successful track record in SDN delisting and enforcement defense; regularly publishes sanctions analysis (sanctionlaw.com blog); 17+ years national security law experience
- **Cons**: Expensive; U.S.-focused; overkill for simple IP-based false-flag suspensions (those should be resolved via GitHub's appeal form, not legal counsel)
- **Industry consensus**: The go-to firm for OFAC-specific legal needs. If your GitHub suspension involves actual SDN designation (not just IP-based location detection), professional OFAC counsel is strongly recommended. Ferrari & Associates is consistently cited in sanctions law circles. evidence: [T02-S033] [T02-S034]

### 32. Gibson Dunn (Sanctions & Export Enforcement)

- **Category**: Legal
- **One-liner**: Global law firm with a top-tier sanctions and export enforcement practice; covers OFAC, BIS, and ITAR matters
- **URL**: https://www.gibsondunn.com/practice/sanctions-and-export-enforcement/
- **Open source?**: N/A
- **Pricing**: Paid (BigLaw rates: $600-$2,000+/hr)
- **When to use**: For complex cases involving enterprise-level sanctions exposure, BIS Entity List restrictions, or criminal enforcement risk. The firm publishes annual sanctions enforcement trend webcasts and reports that are valuable for understanding the landscape. evidence: [T02-S035]
- **Pros**: Global practice with offices worldwide; handles criminal defense, internal investigations, voluntary disclosures, and compliance programs; co-chaired by former senior government officials; publishes industry-leading annual trend reports
- **Cons**: BigLaw pricing (prohibitive for individual developers); overkill for personal GitHub account issues; enterprise-focused
- **Industry consensus**: Best suited for organizations facing enterprise-level sanctions or export control issues. Individual developers with GitHub suspensions should start with Ferrari & Associates (boutique, OFAC-specific) unless the case involves criminal risk. evidence: [T02-S035]

### 33. Hogan Lovells (International Trade & Investment)

- **Category**: Legal
- **One-liner**: Global law firm with Chambers Band 1-ranked sanctions and export controls practice
- **URL**: https://www.hoganlovells.com/en/aof/sanctions
- **Open source?**: N/A
- **Pricing**: Paid (BigLaw rates)
- **When to use**: For multi-jurisdictional sanctions issues (U.S. + EU + UK), especially when the suspension involves cross-border trade control complexity. Hogan Lovells also offers the "Sanctions Navigator" research tool for compliance teams. evidence: [T02-S036]
- **Pros**: Multi-jurisdictional coverage (U.S., EU, UK, Asia); Chambers Band 1 in export controls & economic sanctions; sanctions navigator tool; recent hire of former DOJ National Security Division leaders
- **Cons**: BigLaw pricing; enterprise-focused; not specialized in individual developer issues
- **Industry consensus**: Top-tier for organizations with multi-jurisdictional exposure. Similar to Gibson Dunn in positioning -- enterprise, not individual. evidence: [T02-S036]

### 34. EFF (Electronic Frontier Foundation)

- **Category**: Legal (DMCA)
- **One-liner**: Digital rights non-profit providing DMCA counter-notice templates, guides, and occasional legal representation
- **URL**: https://www.eff.org/issues/dmca / Counter-notice template: https://www.eff.org/document/dmca-counter-notice
- **Open source?**: N/A (non-profit advocacy)
- **Pricing**: Free (resources); legal representation is case-by-case and selective
- **When to use**: When your GitHub suspension is DMCA-related and you believe the takedown was improper (fair use, misidentification, or abuse of DMCA). EFF provides counter-notice templates and guidance. For high-impact cases, EFF may take on direct legal representation. evidence: [T02-S037] [T02-S038]
- **Pros**: Free resources; authoritative DMCA guidance; counter-notice template; advocacy for developer rights; track record of challenging abusive DMCA use
- **Cons**: Cannot take every case; selective about legal representation; not equipped for sanctions cases; guidance is general (not personalized legal advice)
- **Industry consensus**: The first resource to consult for DMCA counter-notice guidance. EFF's counter-notice template is widely referenced. For sanctions-based suspensions, EFF is not the right resource -- go to OFAC specialists instead. evidence: [T02-S037] [T02-S038]

### 35. Software Freedom Conservancy

- **Category**: Legal
- **One-liner**: Non-profit providing GPL enforcement, copyleft compliance, and legal services for open-source projects
- **URL**: https://sfconservancy.org/copyleft-compliance/
- **Open source?**: N/A (non-profit)
- **Pricing**: Free (for member projects and community)
- **When to use**: When your GitHub suspension relates to licensing disputes (GPL violation allegations, copyleft enforcement). Conservancy handles compliance for BusyBox, Git, Samba, and other major projects. evidence: [T02-S039]
- **Pros**: Deep open-source licensing expertise; 15+ years of compliance work; handles hundreds of non-litigation compliance actions; community-oriented enforcement philosophy (compliance over litigation)
- **Cons**: Focused on copyleft/GPL -- not useful for sanctions or account-security suspensions; selective about which projects they support; no capacity for individual developer representation outside member projects
- **Industry consensus**: The authoritative resource for GPL/copyleft-related legal issues in open source. If your suspension involves licensing disputes on GitHub-hosted code, Conservancy is the right organization to consult. evidence: [T02-S039]

---

## Category 7: VPN / Network Tools (with risk warnings)

**CRITICAL WARNING**: VPN/proxy use is a double-edged sword in the GitHub suspension context. It is one of the most common CAUSES of sanctions-related suspension, not a solution.

### VPN Services (Generic)

- **Category**: Network
- **One-liner**: Virtual private networks that route your traffic through servers in other countries
- **Open source?**: Varies (WireGuard is open source; most commercial VPN services are proprietary)
- **Pricing**: Free to ~$12/mo
- **When to use**: **NOT recommended for "solving" a GitHub suspension.** VPN use is explicitly prohibited by GitHub's trade controls policy for users in sanctioned regions. Using a VPN to appear to be in a different country DOES NOT resolve the underlying issue and may worsen it.
- **Pros**: Can provide privacy and security for general internet use; may bypass ISP-level restrictions
- **Cons/Risks**:
  - **VPN exit nodes in sanctioned countries (Iran, Syria, Crimea, North Korea, Cuba) are one of the most common CAUSES of false-flag sanctions suspensions.** If your VPN routes through these regions even briefly, GitHub's automated systems may flag your account. evidence: [T02-S043]
  - **GitHub explicitly prohibits using "IP proxies, VPNs, or other methods to disguise location" for users in sanctioned countries.** Using a VPN to bypass restrictions from a sanctioned region constitutes a violation, not a workaround. evidence: [T02-S043]
  - Repeated VPN switching creates inconsistent geolocation signals that trigger additional risk flags
  - VPN use does NOT change your actual legal status vis-a-vis sanctions
- **Industry consensus**: VPNs are often the PROBLEM, not the solution. Chinese developers who use VPNs to access GitHub (common due to GFW throttling) sometimes get routed through sanctioned-country exit nodes, triggering false-flag suspensions. The correct response is to appeal with proof of actual location (government ID + selfie), not to try a different VPN. For Chinese developers specifically: China is NOT a sanctioned country -- if flagged, it is almost certainly a VPN-induced misidentification, which is highly appealable (~79% success rate per community reports). evidence: [T02-S043]

### Tor Browser

- **Category**: Network
- **One-liner**: Anonymity-focused browser routing traffic through multiple relays
- **When to use**: **NOT recommended for GitHub access.** Tor exit nodes are frequently flagged by GitHub's security systems. Using Tor to access GitHub while suspended will likely trigger additional security flags and may be interpreted as evasion.
- **Industry consensus**: Same risks as VPN, amplified. Tor's exit nodes are well-known and frequently blocklisted. Not a solution for account reinstatement.

---

## Tool Selection Decision Tree

A practical decision flow for someone whose GitHub account has just been suspended or restricted:

```
ACCOUNT SUSPENDED / RESTRICTED
         |
         v
[1] IMMEDIATE: Do you have local clones of your important repos?
    |                                |
    YES                              NO
    |                                |
    v                                v
    Good.                       Can you still clone? (Some suspensions
    Proceed to step 2.          allow read access to your own repos.)
                                     |                    |
                                    YES                   NO
                                     |                    |
                                     v                    v
                                 Run `git clone           Check Software Heritage
                                 --mirror` for            (archive.softwareheritage.org)
                                 every important          for any public repos.
                                 repo NOW.                Ask collaborators for clones.
                                     |                    |
                                     +--------------------+
                                              |
                                              v
[2] DIAGNOSE: What type of suspension is this?
    |                    |                    |
    SANCTIONS/           DMCA                 TOS/AUP
    TRADE CONTROLS       TAKEDOWN             VIOLATION
    |                    |                    |
    v                    v                    v
    Search OFAC SDN      Check Lumen DB       Read the suspension
    List for your        + github/dmca        email carefully for
    name.                repo for the         the specific
    Also search CSL.     notice.              violation cited.
    |                    |                    |
    v                    v                    v
    On SDN list?     Valid claim?          Dispute-worthy?
    |       |        |          |          |          |
   YES      NO      YES        NO        YES         NO
    |       |        |          |          |          |
    v       v        v          v          v          v
  Lawyer  Appeal    Accept;    File DMCA   File       Accept &
  (Ferrari with     remove     counter-    reinstate- learn.
  & Assoc  proof    content;   notice      ment form.
  or       of       request    (use EFF    Explain
  BigLaw)  actual   reinstate- template).  your case.
           location ment.
           (ID +
           selfie).

[3] APPEAL: File reinstatement form (support.github.com/contact/reinstatement)
    |
    Cannot sign in? Use /contact/cannot_sign_in instead.
    |
    v
[4] WAIT: Typical response time is 3-15 business days.
    |
    No response after 2+ weeks?
    |
    v
    Escalate via Twitter @githubsupport (politely, with timeline).
    Post in GitHub Community Discussions.
    |
    v
[5] PARALLEL: While waiting, set up a mirror on an alternative platform.
    |
    Individual?          Team/Enterprise?         Chinese developer?
    |                    |                        |
    v                    v                        v
    Codeberg             GitLab CE                Gitee or JihuLab
    (free, no            (self-hosted,            (domestic hosting,
    self-hosting)        full CI/CD)              GFW-friendly)
    OR Forgejo           OR GitLab.com            plus Codeberg
    (self-hosted         (hosted)                 as international
    on VPS)                                       mirror
    |
    v
[6] REINSTATEMENT GRANTED?
    |           |
   YES          NO
    |           |
    v           v
    Restore.    Permanent: migrate fully to chosen alternative.
    But keep    Export all data via gh CLI + ghorg.
    backups     Consider Radicle for censorship resistance.
    going       For sanctioned individuals: consult OFAC counsel
    forward.    about delisting petition.
```

---

## Phase 2 Distillation Hints

### Must-Have Tools (every practitioner needs these)
1. **GitHub Reinstatement Form** -- the non-negotiable starting point
2. **GitHub "Cannot Sign In" Form** -- the locked-out fallback
3. **`git clone --mirror`** -- minimum viable backup
4. **Recovery Codes** -- the cheapest insurance against lockout
5. **OFAC SDN List Search** -- self-diagnostic for sanctions suspensions
6. **TOTP Authenticator App** -- baseline 2FA (mandated by GitHub since 2024)

### Situational Tools (depends on suspension type)
- **Sanctions suspension**: OFAC SDN Search + CSL + OpenSanctions + Ferrari & Associates (if on SDN list)
- **DMCA suspension**: Lumen Database + github/dmca repo + EFF counter-notice template
- **GPL/license dispute**: Software Freedom Conservancy
- **Mass backup needed**: ghorg + GitHub CLI (`gh api`) + gh2md
- **Migration needed**: Codeberg (individual) / GitLab (team) / Gitee (Chinese developer)
- **Censorship-resistant hosting**: Radicle (P2P, no central authority)

### Emerging / Watch-List Tools
- **Radicle** -- P2P decentralized forge; the most promising "can't be suspended" architecture but still early stage
- **Forgejo Federation (ForgeFed)** -- when mature, will allow cross-instance collaboration, reducing single-platform dependency
- **GitHub Passkeys** -- reducing 2FA lockout risk by replacing password+TOTP with phishing-resistant synced credentials
- **OpenSanctions yente** -- self-hosted sanctions screening API; useful for organizations doing proactive compliance

### Anti-Patterns (tools that seem helpful but are counterproductive)
- **VPN to bypass sanctions restrictions** -- explicitly prohibited by GitHub; causes more suspensions than it solves
- **Tor Browser for GitHub access** -- exit nodes are flagged; amplifies risk
- **Creating a new GitHub account after suspension** -- ban evasion, leads to permanent suspension of both accounts
- **Automated mass-appeal scripts** -- will get your appeal deprioritized or ignored
