When taking over system maintenance, the first question asked is "Where is the source code?" For years, answering "On GitHub" was enough to establish mutual understanding. That was because it was virtually the only option.
Once that premise dissolves, answering "On GitHub" to the same question is no longer sufficient. Under which account? Where else is it duplicated? Whose contract governs that space?
In August 2026, that scenario became reality.
The reality of expanding choices
Cursor released Origin, its code hosting service, in early beta for users on paid tiers (Pro, Teams, Enterprise). Unless administrators explicitly disable it, it is accessible on eligible plans.
Feature-wise, it replaces virtually everything developers do on GitHub: repository storage, code browsing and editing, pull requests, and code reviews. Integrations with Vercel, Depot, and Buildkite were also available on day one.
The design philosophy behind it is that traditional hosting built on the assumption of single humans opening intentional pull requests cannot keep up with pull requests generated by autonomous agents. Cursor cited the fact that roughly one-third of its own pull requests originate from autonomous agents as background context.
However, what matters to clients commissioning work is not the product's philosophy. It is that the obvious reality—contractors choose their code hosting unless the client specifies otherwise—has surfaced for the first time in an environment with real alternatives.
Synchronization is duplication, not migration
Origin does not replace GitHub; it takes the approach of interoperating with it. Existing GitHub repositories can be synchronized and ingested. The word "synchronization" causes verification to be deferred.
With migration, it is obvious to everyone that the storage location has changed. Synchronization preserves the original. The development workflow feels identical, and the repository URL remains active. In reality, however, the exact same code now exists in two places.
When duplicate destinations increase, each of the following grows accordingly:
- Access control management points. Deprovisioning access for departed employees or contractors whose engagements have ended now requires doing so in two places. Revoking access in only one leaves an unintended opening.
- Locations of audit logs. Tracing who exported what and when becomes fragmented across platforms. Actions may be logged on only one side.
- Applicable terms of service. Data handling, retention periods, and deletion procedures differ across services.
None of these are new issues. However, as long as GitHub was the sole option, code locations could be counted as one, so people never developed the habit of verifying them.
The issue of lingering permissions in contractor accounts was discussed in Designing Production Access Granted Only When Needed. The topic here is an even earlier concern: the scope governed by those permissions is itself expanding.
What becomes clear on a day with 6 hours and 42 minutes of downtime
On the very day Origin launched, GitHub experienced a global outage lasting 6 hours and 42 minutes. Error rates reportedly reached roughly 20% overall and neared 50% for file downloads.
While covered in the news as a coincidence of timing, what clients commissioning work should glean is not the competitive landscape, but how many hours their own development and maintenance were stalled.
Companies that needed to deploy urgent fixes that day actually came to a complete halt. If CI cannot pull the repository, builds will not run. And in many cases, these standstills are never tallied after the fact. That is because only the contractor ran into trouble, leaving the client uninformed.
Distributing hosting across multiple providers does not simply solve the problem. Adding more replication targets only multiplies the management touchpoints discussed in the previous section. The key decision is not whether to distribute, but rather deciding in advance what can wait and what cannot when an outage occurs. If there are things that cannot wait, you only need to prepare alternative routes for those specific pieces.
Three lines to include in contracts and operational guidelines
There is no need for an elaborate framework. Simply verify that the following three points are covered in your communications with contractors.
Repository location and ownership. Document this down to which specific GitHub organization it belongs to. If it lives under the contractor's organization, determine the transfer procedure for contract termination at the same time. If you do not settle this during development, you will be forced to negotiate after the relationship has already ended.
Notification when adding replication destinations. This is a single line requiring advance notice whenever a new hosting provider or mirror is added. There is no need to prohibit it. As long as you are aware, you can add it to your access revocation checklist.
Handling during hosting outages. How many hours of downtime trigger an alert, and are there fallback methods for emergency hotfixes? In many cases, the answer will be "nothing specific has been decided," but knowing that it is undecided is valuable in itself.
These do not require full contract amendments; recording three lines in the kickoff meeting minutes is plenty. We have summarized how to handle credentials used in contractor build environments in Contractor build environments running on long-lived tokens. Reviewing this alongside your policies allows you to complete an inventory of your development environment all at once.
What to do next
Pick one development project currently underway and check where its source code is hosted, along with the owner of that organization. If it is owned by the contractor, establish a single-line rule now on how it will be transferred upon contract termination.
For systems already running in production, the most practical first step is to request a list of all accounts with access to the repository. A quick look at that list will immediately reveal whether former employees or members with ended contracts still retain access.
GleamHub assists with development team handovers, source control audits for existing systems, and maintenance acceptance preparations through our Development, AI, and Automation consulting services. Because the approach depends on your team structure and operating status, please consult with us individually. Feel free to reach out via Contact Us.
Sources
- Cursor capitalizes on GitHub frustration, launches rival hosting platform — TechCrunch
- Cursor launches Origin code hosting platform as GitHub outage exposes opening in AI coding race — VentureBeat
- Cursor Launches ‘Origin’ Code Hosting Platform As GitHub Alternative — Slashdot
- Cursor announces "Origin," a Git hosting service for the AI agent era — Publickey
- Origin code hosting — Cursor Changelog
- Incident with Github.com — GitHub Status
