Cyberlium

OSINT › Module 7 › Lesson 3

BeginnerModule 7Lesson 3/5

GitHub Search and gitleaks on YOUR Repo

Secrets hide in git history YOU own — gitleaks YOUR clone, GitHub search YOUR user.

15 min+40 XP3 quiz
Module progress3 of 5

Visual · archive_gitleaks

gitleaks https://github.com/gitleaks/gitleaks on YOUR repo. GitHub code search YOUR user. GATE.

Opening

The leak is often a commit you pushed at midnight, not a genius attacker.

GitHub code search against YOUR username finds things you already published: API tokens in gists,.env samples, old keys. gitleaks (https://github.com/gitleaks/gitleaks) scans a git repo YOU cloned because you own it. Cyberlium forbids scanning a stranger's org “to help them,” forbids dump sites, and forbids pasting other people's secrets into chat. Original Cyberlium. never 0.0.0.0. Next: Lab — Archive and Header Snapshot.

1. Search YOUR user, not the planet

On github.com, signed in as YOU, search code in YOUR repositories and gists. Operators are fine when the namespace is yours. Searching a celebrity's private patterns, or a classmate's homework org, is stalking-adjacent even if GitHub's UI allows a public query.

If you have no GitHub user, write that in notes. Do not create a fake hunt against random popular repos looking for live keys to try. Finding a stranger's secret and using it is crime, not extra credit.

Command guide

Search YOUR user, not the planet

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

brew install gitleaks  # or go install

macOS:

Command — copy this

brew install gitleaks

Windows:

Command — copy this

choco install gitleaks

═══ LINUX / macOS ═══

Scan a git repo for secrets/credentials

Command — copy this

gitleaks detect --source /path/to/repo
gitleaks detect --source /path/to/repo --report-format json --report-path leaks.json

Scan a specific branch

Command — copy this

gitleaks detect --source /path/to/repo --branch main

═══ WINDOWS ═══

Command — copy this

gitleaks detect --source C:\path	o\repo
gitleaks detect --source C:\path	o\repo --report-format json --report-path leaks.json

2. gitleaks is a linter for a repo you already have on disk

Install from the official gitleaks GitHub only if you will point it at a clone YOU own. `gitleaks detect` on that directory reports patterns. Rotate anything real. chmod 600 the report. Do not paste live keys into Discord “for the screenshot.”

Do not gitleaks a repo you cloned “because it was public” unless it is yours or you have a written bug-bounty contract that covers secret scanning — and even then Cyberlium homework is YOUR repo only. This course is not a bounty shop.

3. robots.txt is not a secret scanner; git history is

Archives and headers (lessons 1–2) see the present web. gitleaks sees yesterday's commit. Both belong in self-OSINT. Neither belongs as a stalking pipeline.

Never bind 0.0.0.0 to “share the leak report” with a class. They scan their own clones.

4. What you ship: GitHub self-search rule plus gitleaks-on-YOUR-clone

Official gitleaks URL recorded. GitHub search limited to YOUR user. Optional detect on YOUR clone, report chmod 600. No stranger orgs. SAFE

5. What you record before the next lesson

Date. Secrets search = YOU. DEMO GATE. NEVER dump sites. File t12-m07-l03-gitleaks.txt.

6. Wrong vs right: strangers vs identifiers YOU own

Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.

  • Wrong

    gitleaks a random popular repo and try the keys. GitHub search a classmate. Paste tokens in Discord.

  • Right

    YOUR user, YOUR clone, rotate YOUR leaks. Next: Lab — Archive and Header Snapshot.

Mission: look for leftovers in YOUR git, not theirs

1) / STOP if router. 2) Bookmark gitleaks official repo. 3) GitHub-search YOUR user or skip; optional gitleaks on YOUR clone. Never scan stranger orgs. Never use found stranger secrets.

Stuck? Ask Cyberlium AI Mentor

If gitleaks is missing, ask Mentor for the official install page — not for a “public repo hunting” script.

Knowledge Check

1

APPLY: gitleaks in Cyberlium runs against:

Multiple choice

Knowledge Check

2

APPLY: True or False: Finding a stranger's AWS key in a public repo means you should try it “to prove it works.”

True or False

Knowledge Check

3

APPLY: GitHub code search for this lesson:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)