loading
Loading content
loading
Recon
Filter scraped GitHub archive CSVs by star, fork, and watcher floors.
overview
Sits after a GitHub archive scrape. Reads local CSVs, applies popularity floors, and writes a folder of repos and users that cleared the bar.
Reach for it when the scrape firehose is too large for manual review and you need star, fork, and watcher thresholds before secret scanning.
Inputs are --repos-file, --users-file, or --logs-folder. It does not call the live GitHub API; trufflehog and gitleaks run on what it keeps.
use cases
Feed in the repos and users CSVs from a scrape and apply popularity thresholds so analysts review the standout accounts instead of every exported row.
Set minimum forks, stars, and watchers to keep only the projects with real traction, which is where internal tooling and leaked material tend to cluster.
Run it across a folder of logged repo and user CSVs to map which projects and developers carry the most weight around a target organization.
Use the filtered folder as the input list for secret scanning or contributor analysis so those slower stages run only against the repos that cleared the bar.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| repos-file | FILE | --repos-file | The path of the file containing the repos csv files. |
| users-file | FILE | --users-file | The path of the file containing the users csv files. |
| logs-folder | FOLDER | --logs-folder | The path of the folder containing the users and/or repos csvs. |
| minimum-forks | STRING | --minimum-forks | Min forks of repos. |
| minimum-stars | STRING | --minimum-stars | Min stars of repos. |
| minimum-watchers | STRING | --minimum-watchers | Min watchers of repos. |
Showing key inputs. gh-investigator exposes 6 inputs in total.
example
# gh-investigator: filter archive CSVs for notable reposgh-investigator --repos-file repos.csv --minimum-stars 50 --minimum-forks 10example/security-tools stars=120 forks=40example/infra-scripts stars=80 forks=12example/legacy-api stars=55 forks=10example/docs stars=60 forks=8example/sdk stars=200 forks=70guidance
Run gh-investigator after a scraper has written repo and user CSVs. Tune --minimum-stars, --minimum-forks, and --minimum-watchers, then hand the folder to secret scanners. It filters offline; it does not collect.
Scans repos for leaked secrets. Run it on the high-signal repos gh-investigator keeps, not in place of the filter.
Secret scanner for git history. gh-investigator chooses which repos are worth that pass.
Pulls subdomains from GitHub code search. A different GitHub OSINT path that complements CSV filtering.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A folder of scraped GitHub CSVs feeds gh-investigator, which filters by forks, stars, and watchers and writes the standout repos and users as a folder of results.
Facts on this page come from the live Trickest tool library.