github-secret-hunting

Use GitHub code search dorks for patterns like filename:.env or DB_PASSWORD, then run TruffleHog against the organization to scan full commit history. Filter results to verified secrets only, since most search hits are documentation examples rather than real leaks.

Run trufflehog github with the --org flag, a personal access token, and --only-verified to scan every repository in the organization. Output results as JSON and parse with jq to extract detector names and raw secret values.

GitDorker performs targeted GitHub search queries using dork lists, which is fast for finding specific file types. TruffleHog scans full git history including deleted commits and can cryptographically verify whether discovered secrets are still active.

Yes, self-hosted GitLab instances can be scanned using their API with a PRIVATE-TOKEN header to enumerate accessible projects. Use gitleaks detect with the instance URL and access token to deep-scan repositories for secrets.

Most search results are documentation, tutorials, and example files rather than real leaks. Focus on .env, .config, .npmrc, and CI/CD workflow files, and always verify candidate secrets with a minimal API call before reporting.

Make a minimal authenticated API call, such as GET /user for GitHub tokens or listing models for OpenAI keys. Check the commit date to confirm the secret was pushed recently, and never use credentials beyond minimal verification.