GitHub code-leak discovery

When it applies

Recon of an organisation whose developers publish code. Public repos, gists, and — crucially — old commits routinely leak API keys, cloud credentials, internal hostnames, and endpoints that open a foothold no scanner of the live app would find.

Why it works

Secrets get committed and then "removed" in a later commit — but git keeps history, so the secret is still reachable. Developers also mirror internal tooling, config, and infrastructure names into public repos, handing you the attack surface and sometimes the keys to it.