Tools · Ethical OSINT and privacy self-defense · 24 / 25
A commit email is not a staff roster
The author email on a public commit in a repository you are allowed to review is a string in that commit. It is not an HR roster and not proof the person currently works there. Write the string, and do not go looking for a private individual.
The email is a commit field
A public commit stores an author name and an author email as the commit recorded them. Those strings are what the commit contains. They are not a directory of employees, and they are not a home address.
This applies to your own public repository or one an organization authorized you to review. You do not use the email to investigate someone who did not agree to that review.
The string is not current employment
A person can put a personal address, an old address, or a role address on a commit. The field does not say they work there today. If the organization needs that fact, it comes from the organization, not from the commit.
Do not search for the human behind the address, visit a location, or open private profiles. The defensive note is the string and the repository, plus a suggestion to use a role address if the commit is one the organization owns.
What to write down
File the repository, the commit id, and the author email as printed. Label it as a commit field. If you did not confirm employment with the organization, write “employment not confirmed here.”
Lab: an old address on a lab commit
Authorized review of github.com/example-labs/notes, commit abc123, author email lab-old@example.net. A draft adds the person to the current staff list and starts a search for their other accounts.
The note quotes the repository, the commit, and the email as a commit field. Employment is not confirmed from the commit. No search for other accounts is done. The follow-up, if the organization wants one, is their own roster, not a hunt.
repo: example-labs/notes commit: abc123 author email: lab-old@example.net write: commit field employment: not confirmed here not: a staff roster, and not a search for the person
Diagram
Keep a commit email inside the commit
- Repository
The public repo you were allowed to review.
example-labs/notes
- Commit
The id that holds the string.
abc123
- Author email
The field as printed.
lab-old@example.net
- Stop
No roster entry and no search for a private person.
ask the organization
Check yourself
1. A commit you are allowed to review shows author email lab-old@example.net. What is that?
2. The organization has not confirmed employment. What do you add to the note?
3. Who can say whether the address is a current employee?