# (Problem) Unauthenticated cloning of private repos is allowed

**URL:** <https://forum.gitea.com/t/problem-unauthenticated-cloning-of-private-repos-is-allowed/11730>\
**Category:** Install/Maintain/Configure\
**Created:** [October 9, 2025, 4:25pm UTC](https://forum.gitea.com/t/problem-unauthenticated-cloning-of-private-repos-is-allowed/11730 "2025-10-09T16:25:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![selfhostedftw](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@selfhostedftw](https://forum.gitea.com/u/selfhostedftw)\
**Post date:** [October 9, 2025, 4:25pm UTC](https://forum.gitea.com/t/problem-unauthenticated-cloning-of-private-repos-is-allowed/11730/1 "2025-10-09T16:25:44Z")

</div>

Hello,

I’ve browsed around a lot, but cant find a solution to a problem that i am facing.

I have a self hosted Gitea instance running on a k3s cluster.

My problem is that I am able to clone,push and pretty much everything to repos without absolutely any authentication.

I am not using SSH.

Configs: (that I think may be relevant)

[repository]  
FORCE\_PRIVATE = true  
DEFAULT\_PRIVATE = private  
DISABLE\_HTTP\_GIT = false

[service]  
DISABLE\_REGISTRATION = true  
REQUIRE\_SIGNIN\_VIEW = true  
ENABLE\_REVERSE\_PROXY\_AUTHENTICATION = false  
ENABLE\_REVERSE\_PROXY\_AUTHENTICATION\_API = false

I believe my expectation is kinda self explanatory… i don’t want everyone to just clone,push commits and etc. to my repos and do whatever they want.

Am I missing something?

The Gitea instance is publicly facing over https if that matters…