<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-public-code-repositories
description: >-
  Analyze public code repositories on GitHub, GitLab, and Bitbucket to discover
  exposed secrets, API keys, internal infrastructure details, and sensitive
  code for OSINT and attack surface assessment.
domain: cybersecurity
subdomain: osint-recon
tags:
  - github-osint
  - secrets-detection
  - code-search
  - git-recon
  - api-keys
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  trufflehog, gitleaks, gitrob, github-dorker, gh CLI,
  GitHub Search API, GitLab API.
metadata:
  mitre-attack:
    - "T1593.003"  # Search Open Websites/Domains: Code Repositories
    - "T1552.001"  # Unsecured Credentials: Credentials In Files
---

# Analyzing Public Code Repositories

## Overview

Public code repositories are a rich OSINT source — developers inadvertently
commit API keys, database credentials, internal URLs, infrastructure configs,
and proprietary code. Techniques include GitHub/GitLab code search, commit
history mining, secret scanning with regex/entropy detection, and organization
mapping through contributor analysis.

## Prerequisites

- trufflehog for secret scanning with verification
- gitleaks for regex-based secret detection
- gh CLI for GitHub API queries
- Python 3.10+ with `requests`, `PyGithub`
- GitHub personal access token for API rate limits

```bash
brew install trufflehog gitleaks gh
pip install PyGithub requests
```

## Quick Reference

| Task | Command |
|------|---------|
| Trufflehog scan | `trufflehog github --org=targetorg --only-verified` |
| Gitleaks repo | `gitleaks detect --source=/path/to/repo -v` |
| GitHub code search | `gh search code "org:targetorg password"` |
| Commit emails | `git log --format='%ae' \| sort -u` |
| Org members | `gh api /orgs/targetorg/public_members --jq '.[].login'` |
| Repo list | `gh repo list targetorg --limit 100 --json name,url` |

## Workflow

### Step 1: Organization and User Discovery

```bash
# List public repos for an organization
gh repo list targetorg --limit 200 --json name,url,isPrivate,pushedAt

# Public members
gh api /orgs/targetorg/public_members --jq '.[].login'

# User repos and activity
gh api /users/targetuser/repos --jq '.[].full_name'
gh api /users/targetuser/events --jq '.[].type'
```

### Step 2: Code Search for Secrets

```bash
# GitHub code search via CLI
gh search code "org:targetorg api_key" --limit 50
gh search code "org:targetorg password" --limit 50
gh search code "org:targetorg secret" --limit 50
gh search code "org:targetorg AWS_ACCESS_KEY_ID" --limit 50

# Search for internal domains
gh search code "org:targetorg internal.example.com" --limit 50

# Search for config files
gh search code "org:targetorg filename:.env" --limit 50
gh search code "org:targetorg filename:config.yml password" --limit 50
```

### Step 3: Secret Scanning Tools

```bash
# Trufflehog — scans with verification of found secrets
trufflehog github --org=targetorg --only-verified --json > secrets.json
trufflehog git https://github.com/targetorg/repo.git --only-verified

# Gitleaks — regex-based detection across git history
gitleaks detect --source=./cloned_repo -v --report-path=gitleaks.json
gitleaks detect --source=./cloned_repo --report-format=sarif

# Scan all org repos
for repo in $(gh repo list targetorg --limit 100 --json name -q '.[].name'); do
  git clone --depth 50 "https://github.com/targetorg/$repo"
  gitleaks detect --source="./$repo" --report-path="gitleaks_${repo}.json"
done
```

### Step 4: Commit History Mining

```bash
# Extract contributor emails
git log --all --format='%ae' | sort -u > commit_emails.txt

# Search commit messages for sensitive terms
git log --all --oneline --grep="password\|secret\|key\|credential"

# Find deleted secrets in git history
git log --all --diff-filter=D -- "*.env" "*.key" "*.pem"
git log --all -p -- "*.env" | grep -E "(PASSWORD|SECRET|KEY)="
```

### Step 5: GitHub Dorks

```
# Sensitive files in repos
org:targetorg filename:.env
org:targetorg filename:wp-config.php
org:targetorg filename:id_rsa
org:targetorg filename:.htpasswd
org:targetorg filename:credentials.json

# API keys and tokens
org:targetorg "AKIA" (AWS access key prefix)
org:targetorg "sk-" (Stripe/OpenAI key prefix)
org:targetorg "ghp_" (GitHub personal access token)
org:targetorg "xoxb-" (Slack bot token)
```

## Detection Opportunities

- GitHub Advanced Security detects secrets pushed to repos
- Repository audit logs show clone and fork activity
- Secret scanning alerts notify on known token patterns
- Commit signing reveals unsigned/suspicious commits

## Verification

- [ ] Organization repos enumerated with metadata
- [ ] Code search performed for credentials, keys, and internal URLs
- [ ] Trufflehog/gitleaks scanned repos with verified findings
- [ ] Commit history mined for contributor emails and deleted secrets
- [ ] GitHub dorks executed for sensitive file patterns
- [ ] Findings classified by severity and verified status

## References

- [Trufflehog](https://github.com/trufflesecurity/trufflehog)
- [Gitleaks](https://github.com/gitleaks/gitleaks)
- [GitHub Code Search](https://docs.github.com/en/search-github/searching-on-github/searching-code)
- [GitHub API](https://docs.github.com/en/rest)

---
v1.0 | Validated: 2026-03-17
