On the one hand if you can argue that someone can guess the unique gist ID, you could also argue they can guess your Github session ID, in which case authentica

On the one hand if you can argue that someone can guess the unique gist ID, you could also argue they can guess your Github session ID, in which case authentication is moot* On the other hand, because the Gist ID is in the URL, it is more prone to leaking. One example: I uploaded a PDF (classification: public) to a web server and sent the link to a few people. It was not published anywhere, not communicated outside our group, there were no external links to it, so it could not be spidered. Couple of days later Google had managed to index it, and it was getting downloads. How did Google know it existed? Maybe someone used GMail, maybe they had Google toolbar installed which submits URLs to Google for indexing, who knows? I noticed Github has blocked Google et al from indexing all the Gists with robots.txt, which helps. Either way, probably best to be careful how you handle the "private" Gist URLs, or just don't use them for super secret information. *yes session ID is longer, and should have a finite life span, so it may be harder, but the same kind of issue.