GitHub Secret Hunting

Scan public GitHub repositories for leaked API keys, tokens, passwords, and internal infrastructure details. Developers accidentally push secrets constantly — this skill uses targeted dorking, automated scanning tools, and real-time monitoring to find credentials before the developer notices and revokes them.

When to Use

• Target has public repositories under an organization account.
• JS bundle analysis reveals internal service names — search GitHub for related config files.
• Need to find valid API keys for cloud services, payment gateways, or third-party integrations.
• The target uses CI/CD systems that may leak tokens in build logs or workflow files.
• Want real-time monitoring for new secret leaks from the target org.

Prerequisites

• terminal with python3, curl, git.
• GitHub Personal Access Token (only public_repo scope needed).
• Tool dependencies: TruffleHog, GitDorker, gitleaks.

Quick Detection