GitHub does not use raw directory indexing for user repositories, but many developers host static files on Amazon S3 or DigitalOcean Spaces without disabling listing. Countless accidental exposures happen because a developer creates a public S3 bucket and sets permissions to “List” for everyone.
If you never want autoindex anywhere, set autoindex off; in the http block. parent directory index of downloads
Web servers are configured to handle requests for directories in one of two ways: GitHub does not use raw directory indexing for
Understanding "Parent Directory Index of Downloads": Navigation, Security, and Advanced Search set autoindex off