Discovery
Find credentials leaked into public GitHub code
Hunt public GitHub code for leaked credential files.
overview
What git-wild-hunt does
git-wild-hunt queries the GitHub code search API for files that match a secret-shaped --search expression. It pulls matching public files and writes hits for review, not live-host secret scanning.
Shape the hunt with path, filename, extension, and language qualifiers. A query like path:.aws/ filename:credentials or path:.kube filename:config chases one leak class. The config file sets run behavior and should point output at /hive/out/results.json.
Reach for it during a public-footprint exposure pass when you expect credential files in committed source. Pair with a JSON parse stage to separate live secrets from search noise before anyone acts.
use cases
Where git-wild-hunt fits
Find leaked cloud credentials in public repos
Search for path and filename patterns like .aws/credentials or .azure access tokens to surface cloud secrets that developers pushed to public GitHub by mistake.
Run an organization exposure assessment
Sweep public GitHub for the kinds of files your engineers handle, then collect the hits into a results file so security can review what is exposed before an attacker finds it.
Hunt for Kubernetes and config secrets
Target path:.kube filename:config and similar expressions to catch cluster configs, kubeconfigs, and service files that carry credentials in plaintext.
Feed findings into a triage pipeline
Write results as JSON, then parse and filter them downstream so the team works from a deduplicated list of real secrets instead of raw search noise.
reference
git-wild-hunt inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| config | FILE | · | Config file path that controls the run; the repository ships a template, and the output variable should point at /hive/out/results.json. |
| search | STRING | --search | GitHub search query to execute, for example path:.aws/ filename:credentials or path:.kube filename:config. |
Showing key inputs. git-wild-hunt exposes 2 inputs in total.
example
Run git-wild-hunt
# hunt public GitHub for AWS credential filesgit-wild-hunt --search 'path:.aws/ filename:credentials'api.example.comstaging.example.comci.example.comops.example.commail.example.comvpn.example.comgitlab.example.comcdn.example.comguidance
Choosing git-wild-hunt
Use git-wild-hunt when the leak lives in public GitHub source, not on a running host. Drive it with a tight --search and a config that lands results as JSON. Pair with gh-scraper for broader GitHub collection, or gh-investigator when you need to pivot from a hit to the pushing account.
gh-scraper
Broader GitHub repository and code collector. git-wild-hunt targets credential-shaped --search queries.
git-log4j
Hunts GitHub for a vulnerable pattern, not leaked secrets. Same source, different target.
gh-investigator
Investigates GitHub accounts and activity. Pivot from a leaked file to the user or org that pushed it.
faq
git-wild-hunt questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run git-wild-hunt yourself
A config and search query drive git-wild-hunt, which hunts public GitHub for matching secrets and passes the results to a parser so triaged, leaked credentials land as output.
Facts on this page come from the live Trickest tool library.