[BUG] Sponsor status can be incorrectly granted through GitHub username recycling because synchronization relies on github_login instead of immutable account identifiers

[Ridanshi]

Bug Summary

The sponsor synchronization workflow grants sponsor privileges by matching GitHub usernames rather than immutable GitHub account identifiers.

If a sponsored username is later recycled, sponsor privileges can be incorrectly assigned to a different user.

Describe the bug

The sponsor synchronization job updates users using:

github_login

instead of an immutable GitHub identifier.

GitHub usernames can change over time and may eventually become available for reuse.

If a sponsored account changes its username and another user later claims the original username, the synchronization process can mistakenly grant sponsor privileges to the wrong account.

To Reproduce

1. User A sponsors the project.
2. Sponsor synchronization marks User A as a sponsor.
3. User A changes their GitHub username.
4. A different GitHub account later acquires the original username.
5. Sponsor synchronization runs again.
6. Observe that sponsor status may be assigned to the new owner of the recycled username.

Expected behavior

Sponsor synchronization should use immutable GitHub account identifiers.

Sponsor status should remain tied to the original GitHub account.

Actual behavior

Sponsor status is matched using github_login.

Additional context

Affected file:

src/app/api/sponsors/sync/route.ts

Potential impact:

• unauthorized sponsor privileges
• incorrect access levels
• sponsor-only feature exposure
• account ownership confusion

[Ridanshi]

I investigated this issue and would like to work on a fix.

The sponsor synchronization workflow currently matches users using mutable GitHub usernames, which can result in incorrect sponsor assignments after username changes or recycling.

I plan to:

• migrate sponsor matching to immutable GitHub identifiers
• preserve existing sponsor synchronization behavior
• add regression coverage for username change scenarios

Please assign this issue to me.

[github-actions]

✅ Closed as completed!

If DevTrack has been useful, a ⭐ star on the repo helps the project grow and reach more developers.