Is buying GitHub stars safe?

September 23, 2026 · 10 min read

GitHub stars are the most public signal an open-source project has, and a market grew up around manufacturing them. At least twelve websites sell stars publicly, and the most detailed study of the market - presented at ICSE 2026 - counts six million suspected fake stars across 18,617 repositories. So "is buying GitHub stars safe" is not a hypothetical question: it is a real market with real enforcement data behind it.

The honest answer has three parts. It depends on how the stars are delivered, what happens when delivery accounts get cleaned up, and what you do with the number afterwards. This guide separates those three questions, using the same public research that platforms and journalists rely on.

Risk 1: your repository

This is the risk buyers actually mean. GitHub's Acceptable Use Policies prohibit inauthentic activity, and enforcement is real: the ICSE study found that 90.42% of the repositories flagged by its StarScout detector were eventually deleted by GitHub. That number deserves its context - the detector flagged coordinated campaigns, bursts from empty accounts and networks starring repositories in lockstep, not every purchase.

What enforcement responds to is a signature, not a receipt. A repository that gains 300 stars in a smooth slope across a launch week is indistinguishable from the many projects that genuinely launch that way. A repository that gains 300 stars in eleven minutes from accounts created last Tuesday is a different object, and it is the one that gets reviewed. The study named both patterns: the low-activity signature and the lockstep signature.

Risk 2: your account, and the accounts behind the order

Buyers rarely lose their own accounts for placing an order; the accounts at risk are the ones doing the starring. The study counted roughly 301,000 accounts involved in campaigns and found only 57% were cleaned up - which means delivery pools are full of flagged accounts, and a provider renting fresh accounts per order is passing that risk to you in the form of drops.

The one way to expose your own account is to hand over access. Delivery never requires a password, a personal access token, an OAuth grant or collaborator rights - only the public repository URL. Any provider asking for more is creating a security problem that has nothing to do with stars.

Risk 3: what you do with the number

This is the risk no service can manage for you. The FTC's 2024 final rule on fake reviews and testimonials carries penalties up to $53,088 per violation, and US securities law applies when inflated metrics are shown to investors. GitHub's terms prohibit fake stars regardless. Paid visibility is a marketing decision; presenting it as proof of traction is a different decision with different exposure. Keep the two separate, and the third risk stays theoretical.

How GitHub changed what the public can see

On June 30, 2026, GitHub restricted stargazer and watcher lists to repository admins and collaborators. On September 4, 2026, it shipped a privacy-safe star history endpoint that returns weekly and daily counts without exposing identities. Two consequences matter here. First, third parties can no longer inspect individual stargazers, so public verification now works from aggregate patterns. Second, the curve itself became the strongest public fingerprint - which is exactly why pacing is the difference that shows. The full method is in our guide on how to tell if GitHub stars are real.

Two delivery patterns, two risk profiles

Every commercial order is one of two things: a burst or a slope. The difference is not cosmetic. It decides what the order looks like to detection, and what survives a cleanup.

	Fresh-account burst	Aged-account paced
Accounts	Created for the order; empty profiles, no history	Real profiles with years of commits, followers and activity
Timing	Minutes to hours; one vertical spike	Spread across 12–24 hours in uneven clusters
Public pattern	A step, then silence	A slope consistent with a real launch
In a cleanup	First accounts removed; stars drop	History survives; rare drops are replaced
Credentials	Sometimes a token is requested	Public repository URL only

Pacing is not a marketing detail. A 1,000-action order delivered in one burst is the exact signature the ICSE research associates with removal. The same order spread across a day reads as an audience arriving.

The five checks that make an order defensible

1. Inspectable account history. Ask for a sample profile. Real aged accounts have their own repositories, followers, contribution graphs and often achievement badges. Fresh pools cannot fake years.
2. Paced delivery inside a window. "12–24 hours" is a pacing promise; "instant" is a burst promise. You want the slope.
3. Signals that arrive together. Stars joined by forks, watches and followers look like adoption. A lone star spike with everything else flat is the anomaly everyone looks for.
4. No credentials, ever. Public repository URL only - no password, token, OAuth or collaborator access.
5. Written replacement terms. Drops happen even in quality pools. A no-drop guarantee with free replacement is the provider accepting that risk instead of leaving it with you.

What no provider can honestly promise

If you are still deciding

Size the first order to a real moment in your project's life, then watch what it looks like afterwards. A modest package delivered gradually is defensible in reputation terms; a dramatic one is not. If budget is the question, our pricing breakdown shows where the market tiers sit and why account age drives price, and the cheap-stars breakdown covers what the lowest listings hide. If you want to see the mechanics first, the delivery method walks an order through step by step.

Our own approach is written down in full: stars from aged accounts with real commit history, paced over 12–24 hours, delivered together with forks, watches and followers, no credentials ever, and a no-drop guarantee that replaces anything that falls. That is what buying stars from RepoBoost includes - and the 2009–2024 aged accounts behind it are the reason the pattern survives scrutiny.

FAQ

Is buying GitHub stars safe?

It is a risk decision, not a yes-or-no. Stars delivered from aged accounts with real commit history, paced gradually over 12–24 hours, and without any access to your account carry far less risk than burst delivery from fresh, empty profiles. The pattern is what enforcement targets.

Can my repository get banned for buying stars?

GitHub's terms prohibit inauthentic activity, and enforcement does remove repositories: in the ICSE 2026 fake-star study, 90.42% of the repositories its detector flagged were eventually deleted. In practice, enforcement follows the loudest signatures - synchronized bursts from new accounts with no history. Pacing and account age exist to avoid that signature.

Do bought GitHub stars drop?

They can, when the accounts behind them are cleaned up. That risk concentrates in fresh-account delivery, because those accounts are first in any cleanup wave. Aged accounts with real history survive far better, and a serious provider backs the order: our no-drop guarantee replaces anything that falls at no cost.

Does buying stars violate GitHub's terms?

Yes - GitHub's Acceptable Use Policies prohibit inauthentic activity, and that includes fake stars. The terms are enforced against patterns like coordinated bursts rather than against a repository owner directly in most cases, but anyone buying growth should know the terms exist and decide with that risk in view.

Do I need to give my GitHub password or token?

No. Legitimate delivery only needs the public repository URL - no password, no personal access token, no OAuth grant, no collaborator access. A provider asking for any of those creates a security risk that has nothing to do with stars.

How many stars should I start with?

Start with an order sized to a real moment. 1,000 actions paced across 12–24 hours reads like a launch; 5,000 in an hour never will. Begin smaller, watch the curve, and scale once the pattern still looks organic.

Sources

• He, Yang, Burckhardt, Kapravelos, Vasilescu, Kästner. Six Million (Suspected) Fake Stars on GitHub. ICSE 2026. DOI 10.1145/3744916.3764531.
• GitHub. Acceptable Use Policies - inauthentic activity.
• GitHub Changelog. Upcoming access restrictions to public API endpoints and UI views. June 30, 2026.
• GitHub Changelog. New API endpoint provides privacy-safe star history data. September 4, 2026.
• Carnegie Mellon University, School of Computer Science. Fraudsters Use Fake Stars To Game GitHub. September 2025.
• Federal Trade Commission. Final rule banning fake reviews and testimonials. August 2024.