Recon
Cut archive CSVs down to high-signal repos
Filter scraped GitHub archive CSVs by star, fork, and watcher floors.
overview
What gh-investigator does
Sits after a GitHub archive scrape. Reads local CSVs, applies popularity floors, and writes a folder of repos and users that cleared the bar.
Reach for it when the scrape firehose is too large for manual review and you need star, fork, and watcher thresholds before secret scanning.
Inputs are --repos-file, --users-file, or --logs-folder. It does not call the live GitHub API; trufflehog and gitleaks run on what it keeps.
use cases
Where gh-investigator fits
Triage a large GitHub archive scrape
Feed in the repos and users CSVs from a scrape and apply popularity thresholds so analysts review the standout accounts instead of every exported row.
Surface high-signal repositories
Set minimum forks, stars, and watchers to keep only the projects with real traction, which is where internal tooling and leaked material tend to cluster.
Profile an organization's open-source footprint
Run it across a folder of logged repo and user CSVs to map which projects and developers carry the most weight around a target organization.
Seed downstream OSINT on the right targets
Use the filtered folder as the input list for secret scanning or contributor analysis so those slower stages run only against the repos that cleared the bar.
reference
gh-investigator inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| repos-file | FILE | --repos-file | The path of the file containing the repos csv files. |
| users-file | FILE | --users-file | The path of the file containing the users csv files. |
| logs-folder | FOLDER | --logs-folder | The path of the folder containing the users and/or repos csvs. |
| minimum-forks | STRING | --minimum-forks | Min forks of repos. |
| minimum-stars | STRING | --minimum-stars | Min stars of repos. |
| minimum-watchers | STRING | --minimum-watchers | Min watchers of repos. |
Showing key inputs. gh-investigator exposes 6 inputs in total.
example
Run gh-investigator
# gh-investigator: filter archive CSVs for notable reposgh-investigator --repos-file repos.csv --minimum-stars 50 --minimum-forks 10example/security-tools stars=120 forks=40example/infra-scripts stars=80 forks=12example/legacy-api stars=55 forks=10example/docs stars=60 forks=8example/sdk stars=200 forks=70guidance
Choosing gh-investigator
Run gh-investigator after a scraper has written repo and user CSVs. Tune --minimum-stars, --minimum-forks, and --minimum-watchers, then hand the folder to secret scanners. It filters offline; it does not collect.
trufflehog
Scans repos for leaked secrets. Run it on the high-signal repos gh-investigator keeps, not in place of the filter.
gitleaks
Secret scanner for git history. gh-investigator chooses which repos are worth that pass.
github-subdomains
Pulls subdomains from GitHub code search. A different GitHub OSINT path that complements CSV filtering.
faq
gh-investigator questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run gh-investigator yourself
A folder of scraped GitHub CSVs feeds gh-investigator, which filters by forks, stars, and watchers and writes the standout repos and users as a folder of results.
Facts on this page come from the live Trickest tool library.