Sign-up puts new GitHub accounts on a seven-day cooling-off period
Your first sign-in now checks how old your GitHub account is and whether its email is confirmed. Miss either mark and the site turns you away.
Top storyTook the lead from Timezones join the conversation #155. Sign-in now blocks GitHub accounts younger than seven days or without a confirmed email, so newcomers must wait a week while existing users skip the check. Held off 1 challenger since.
Click Sign in with GitHub with a brand-new account and you bounce straight back to the home page, a toast explaining that accounts younger than 7 days cannot join yet. Nothing is created. You get no profile and no log. Wait out the week, click again, and you land in your log.
Credit goes to eznix86, who put a bouncer on the sign-in callback. It reads the creation date GitHub publishes for the account, compares it with a cutoff 7 days back, and lets an account exactly 7 days old through. It also turns away anyone whose GitHub profile comes back without an email address, which it treats as no confirmed primary address. The login redirect and the callback now take ten requests a minute, and in production the session cookie is marked secure by default. Anyone who has signed in before skips both checks. You set the waiting period with SIGNUP_MIN_ACCOUNT_AGE_DAYS and switch the email rule with SIGNUP_REQUIRE_VERIFIED_EMAIL.
One catch if you run your own copy. Production marks the session cookie secure even when you serve the site over plain http://. Browsers drop that cookie without a word, so signing in bounces you home with the generic GitHub error. Set SESSION_SECURE_COOKIE to false and it behaves.
