GitHub & Git Recon

Code hosts leak identities (commit emails), infrastructure (configs), and secrets (keys). All public and passive.

People from commits

Every commit carries an author name + email. Pull them:

git clone <repo> && git log --all --format='%an <%ae>' | sort -u

GitHub API exposes a user's repos, orgs, gists, followers, and starred repos: https://api.github.com/users/<user>/events/public shows recent activity and timezone (from commit timestamps). Reused commit email → email-osint; handle → username-osint.

Secret hunting