Has anyone tried following a massive number of users on GitHub?

[bzzimmy]

Select Topic Area

Question

Body

I'm a security researcher in GitHub's bug bounty program, with hall of fame recognitions from Red Hat and Vue.js (portfolio). I'm curious whether anyone has ever gotten permission to follow a very large number of users, somewhere around 1M.

I know there are open source follow bots out there like github.com/gamemann/GitHub-Follow-Bot, and some users already have 80K+ following on their profiles, so it's not completely unheard of at scale. But I'm not sure what the actual limits are or whether there's a way to get them raised on a per-account basis.

Has anyone explored this or knows how GitHub handles it? Would love to hear if there's a precedent for this.

[Markosjr]

Hi @BenZimmermann! Impressive portfolio as a security researcher – congrats on the Red Hat and Vue.js Hall of Fame recognitions.

GitHub doesn't publish an explicit "hard" limit for total users an account can follow (following), but enforces strict rate limits via API and web interface to prevent abuse. For follow/unfollow actions (considered "content creation"), there are secondary limits of ~80 requests/minute and ~500/hour globally, plus primary 5,000 requests/hour for authenticated API – making 1M follows manually or via bot extremely slow (weeks/months, depending on throttling).

There are precedents of accounts at scale: a user with +302k following was recently discussed on Reddit (likely via automated bot like the one you mentioned), and you cited 80k+ profiles. Open-source bots like
GitHub-Follow-Bot
handle delays and retries to work around rate limits, but still hit API walls (e.g., configurable max_api_fails). No public evidence of 1M, but hundreds of thousands is feasible with patience/optimization.

Regarding per-account limit increases: no official docs for this on standard personal/org accounts (unlike elevated limits for GitHub Apps or Enterprise). Best path is opening a ticket at GitHub Support explaining legitimate use case (e.g., security research, profile network) – they occasionally adjust for approved cases, but spamming is bannable. Have you explored GraphQL API for batching? (even with points system).