Which repositories are recorded

payback records only repositories your allow list covers, and setup’s default covers public GitHub repositories only. Nothing outside a git repository with a GitHub origin is ever recorded. The list is ~/.payback/allow, one line per entry. You never need to edit it by hand: payback allow sets everything, and payback on / payback off change the repository you’re in.

The policy

Line	Meaning	Who writes it
`public`	Any repository whose GitHub origin is public, now or in future.	Setup, when you choose Turn on for all public repos (the default). `payback allow public`.
`owner/name`	That repository, whatever its visibility: every clone and worktree of it, wherever it is on disk.	Setup’s Choose repos; `payback allow owner/name`; `payback on`. This is the only way a private repository is ever recorded, and it still never becomes an environment.
`!owner/name`	Never that repository.	`payback allow --exclude`, `payback off`.
`*`	Every repository, private ones too.	Only `payback allow every`, after a confirmation. Setup never writes it.

Exclusions always win over everything else on the list. A .payback-ignore file at a repository’s root excludes it just like a ! line, and protects everyone who clones that repository. Repositories are matched on the origin remote, so a git worktree or a second clone counts as the same repository. A fork is its own repository: you/flask and pallets/flask are different entries.

The visibility check

Under public, the hook doesn’t know whether a repository is public; it records the turn locally and marks it “decide at upload”. Before anything leaves your machine, the uploader asks our server whether the repository is public on GitHub. Public: the turn is uploaded. Private, or unknown: the turn is deleted from your machine and never sent, and payback status counts it as kept off because the repository isn’t public. The answer is cached in ~/.payback/repo_visibility.json (public for 24 hours, private for 7 days), so after the first turn in a private repository the hook skips it without recording anything. The server keeps its own cache, so a popular repository is looked up on GitHub once for everyone. Your machine never calls the GitHub API.

The command

payback allow                            policy, repos, exclusions, this repo's status
payback allow public | named | every     set the policy (every warns and asks y/N; --yes skips)
payback allow <owner/name | path | .>    add a repo (. = the current one)
payback allow --remove <repo | .>        take it off the list
payback allow --exclude <repo | .>       never record it, whatever the policy (. also writes .payback-ignore)
payback allow --include <repo | .>       undo an exclusion (removes the file for .)
payback on / payback off               shortcuts for the current repo: include+add / exclude

payback allow with no arguments prints the policy, the named repositories, the exclusions, and what that means for the repository you’re in. Every change prints the resulting status on one line.

Record everything public (default)
Only the repositories I name
Keep one repository out

payback allow public

New public clones are covered without running setup again.

payback allow named
payback allow pallets/flask
payback allow ~/code/anki-android

named keeps the names on the list and drops public. A path or . resolves to that checkout’s GitHub origin.

cd ~/work/private-thing
payback off

Writes .payback-ignore at the root (kept out of git) and a !owner/name line. payback on undoes both.

See also What is never recorded and the payback allow reference.

Get started

How it works

Agents

CLI reference

Your data

Help

Which repositories are recorded

The policy

The visibility check

The command

​The policy

​The visibility check

​The command

The policy

The visibility check

The command