OSINT › Module 7 › Lesson 3
GitHub Search and gitleaks on YOUR Repo
Secrets hide in git history YOU own — gitleaks YOUR clone, GitHub search YOUR user.
Visual · archive_gitleaks
gitleaks https://github.com/gitleaks/gitleaks on YOUR repo. GitHub code search YOUR user. GATE.
Opening
The leak is often a commit you pushed at midnight, not a genius attacker.
GitHub code search against YOUR username finds things you already published: API tokens in gists,.env samples, old keys. gitleaks (https://github.com/gitleaks/gitleaks) scans a git repo YOU cloned because you own it. Cyberlium forbids scanning a stranger's org “to help them,” forbids dump sites, and forbids pasting other people's secrets into chat. Original Cyberlium. never 0.0.0.0. Next: Lab — Archive and Header Snapshot.
1. Search YOUR user, not the planet
On github.com, signed in as YOU, search code in YOUR repositories and gists. Operators are fine when the namespace is yours. Searching a celebrity's private patterns, or a classmate's homework org, is stalking-adjacent even if GitHub's UI allows a public query.
If you have no GitHub user, write that in notes. Do not create a fake hunt against random popular repos looking for live keys to try. Finding a stranger's secret and using it is crime, not extra credit.
Command guide
Search YOUR user, not the planet
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install
macOS:
Command — copy this
brew install gitleaks
Windows:
Command — copy this
choco install gitleaks
═══ LINUX / macOS ═══
Scan a git repo for secrets/credentials
Command — copy this
gitleaks detect --source /path/to/repo gitleaks detect --source /path/to/repo --report-format json --report-path leaks.json
Scan a specific branch
Command — copy this
gitleaks detect --source /path/to/repo --branch main
═══ WINDOWS ═══
Command — copy this
gitleaks detect --source C:\path o\repo gitleaks detect --source C:\path o\repo --report-format json --report-path leaks.json
2. gitleaks is a linter for a repo you already have on disk
Install from the official gitleaks GitHub only if you will point it at a clone YOU own. `gitleaks detect` on that directory reports patterns. Rotate anything real. chmod 600 the report. Do not paste live keys into Discord “for the screenshot.”
Do not gitleaks a repo you cloned “because it was public” unless it is yours or you have a written bug-bounty contract that covers secret scanning — and even then Cyberlium homework is YOUR repo only. This course is not a bounty shop.
3. robots.txt is not a secret scanner; git history is
Archives and headers (lessons 1–2) see the present web. gitleaks sees yesterday's commit. Both belong in self-OSINT. Neither belongs as a stalking pipeline.
Never bind 0.0.0.0 to “share the leak report” with a class. They scan their own clones.
4. What you ship: GitHub self-search rule plus gitleaks-on-YOUR-clone
Official gitleaks URL recorded. GitHub search limited to YOUR user. Optional detect on YOUR clone, report chmod 600. No stranger orgs. SAFE
5. What you record before the next lesson
Date. Secrets search = YOU. DEMO GATE. NEVER dump sites. File t12-m07-l03-gitleaks.txt.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
gitleaks a random popular repo and try the keys. GitHub search a classmate. Paste tokens in Discord.
Right
YOUR user, YOUR clone, rotate YOUR leaks. Next: Lab — Archive and Header Snapshot.
Mission: look for leftovers in YOUR git, not theirs
1) / STOP if router. 2) Bookmark gitleaks official repo. 3) GitHub-search YOUR user or skip; optional gitleaks on YOUR clone. Never scan stranger orgs. Never use found stranger secrets.
Stuck? Ask Cyberlium AI Mentor
If gitleaks is missing, ask Mentor for the official install page — not for a “public repo hunting” script.
Knowledge Check
APPLY: gitleaks in Cyberlium runs against:
Multiple choice
Knowledge Check
APPLY: True or False: Finding a stranger's AWS key in a public repo means you should try it “to prove it works.”
True or False
Knowledge Check
APPLY: GitHub code search for this lesson:
Multiple choice