Verified:GitHub

secrets-in-git-history

Extract identities, infrastructure, and leaked credentials from GitHub and GitLab repository history.

38|2|Updated Aug 2, 2026

Search Tags:#github #git history #osint #gitleaks #trufflehog #secret scanning #credential leak

One-click install

npx skills add https://github.com/UseOSINT/Skills --skill secrets-in-git-history-useosint

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: secrets-in-git-history
Source: https://github.com/UseOSINT/Skills/tree/main/skills/secrets-in-git-history
Command: npx skills add https://github.com/UseOSINT/Skills --skill secrets-in-git-history-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Secrets deleted from a repository's HEAD remain in git history and fork networks, and commit metadata leaks author emails and account IDs that the web UI hides. This Skill mines full repository history to recover those identities, internal infrastructure details, and credentials that surface-level scanning misses. ## Core Features & Use Cases - Identity Extraction: Pull commit author emails via the `.patch` endpoint and API, resolve noreply numeric user IDs that survive account renames, and enumerate org members through commit history and the social graph. - Secret Scanning: Run trufflehog and gitleaks over mirror clones with all refs, then pickaxe (`git log -S`) for internal hostnames, cloud account IDs, and strings the scanners have no detectors for. - Triage and Confidence Grading: Distinguish real leaks from placeholders, test fixtures, and publishable keys, with a confirmed/probable/unconfirmed/rejected grading scheme. - Use Case: Given only a company website, code-search its internal domain, mirror-clone the discovered repos, extract fourteen author emails, resolve a renamed account via its numeric ID, and recover a deleted `terraform.tfstate` containing internal hostnames. ## Quick Start Ask the agent to mine the git history of a target GitHub organization for commit author emails, deleted files, and leaked credentials using mirror clones, trufflehog, and gitleaks.

Frequently Asked Questions about secrets-in-git-history

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find secrets deleted from a git repository?▼

Mirror-clone the repository and scan all refs with trufflehog and gitleaks, since secrets removed from HEAD persist in history. Use `git log --all --diff-filter=D` to list deleted files and `git log -S` to trace when a string entered and left.

How to find a GitHub user's email from commits?▼

Append `.patch` to any commit URL or query the commits API endpoint; the `From:` header and `commit.author.email` field carry the author email even though the web UI hides it. Noreply addresses with numeric IDs resolve to the current username via the user API.

TruffleHog vs gitleaks for scanning git history?▼

Run both, since their detector sets and false-positive profiles differ and neither is a superset. TruffleHog can verify candidates with live API calls, while gitleaks is pattern-only and safer when you must not touch the provider.

Does GitHub code search find secrets in git history?▼

No. Code search covers only the default branch, excludes some large or inactive repositories, and uses token-based matching. Treat it as a discovery tool for finding which repositories to clone, then scan history locally.

Why do secret scanners report false positives in repositories?▼

Test fixtures, documentation examples, and provider sample keys like `AKIAIOSFODNN7EXAMPLE` match credential patterns exactly. Triage by checking format, searching the string on the web, and confirming whether the key is publishable by design.

Can I verify a leaked credential by testing it?▼

No. Authenticating with a found credential is unauthorized access under computer-misuse law, even read-only. Establish validity from format, context, and metadata, then disclose through a security contact and recommend rotation.