secrets-in-git-historylisted

# Secrets in git history A repository is three intelligence products: a list of humans with real email addresses, a map of the organisation's infrastructure, and a credential store nobody meant to publish. The costly mistake is scanning the working tree. Secrets deleted from HEAD stay in history forever, and commits deleted from a branch stay reachable through the fork network — scan only what is checked out and you are searching the one place the secret was definitely removed from. ## What you're holding, and where to start | You have | Start with | Why | |---|---|---| | An organisation name | Public org members, then their personal repos | Corporate repos are reviewed; personal ones are not | | A developer's name or handle | Commit emails across their repos | Yields an email nothing else gives you | | A commit email | Reverse-search across hosts; resolve any noreply ID | Links accounts across orgs and platforms | | A suspected credential leak | Both scanners over a mirror clone, all refs | HEAD-only scanning misses the point entirely | | A specific string — hostname, key prefix | `git log -S` pickaxe across all refs | Tells you when it entered and when it left | | A live domain | Check for an exposed `.git` — see the legal note | Full history from a web server, if authorized | | Nothing but a company website | Code search the org's internal domain names | Finds repos with no obvious link to the org | ## The commit email leak Git records an author identity on every comm