HackBlue

Tools · Ethical OSINT and privacy self-defense · 24 / 25

A commit email is not a staff roster

The author email on a public commit in a repository you are allowed to review is a string in that commit. It is not an HR roster and not proof the person currently works there. Write the string, and do not go looking for a private individual.

9 min read · practice only with authorization

The email is a commit field

A public commit stores an author name and an author email as the commit recorded them. Those strings are what the commit contains. They are not a directory of employees, and they are not a home address.

This applies to your own public repository or one an organization authorized you to review. You do not use the email to investigate someone who did not agree to that review.

The string is not current employment

A person can put a personal address, an old address, or a role address on a commit. The field does not say they work there today. If the organization needs that fact, it comes from the organization, not from the commit.

Do not search for the human behind the address, visit a location, or open private profiles. The defensive note is the string and the repository, plus a suggestion to use a role address if the commit is one the organization owns.

What to write down

File the repository, the commit id, and the author email as printed. Label it as a commit field. If you did not confirm employment with the organization, write “employment not confirmed here.”

Lab: an old address on a lab commit

Authorized review of github.com/example-labs/notes, commit abc123, author email lab-old@example.net. A draft adds the person to the current staff list and starts a search for their other accounts.

The note quotes the repository, the commit, and the email as a commit field. Employment is not confirmed from the commit. No search for other accounts is done. The follow-up, if the organization wants one, is their own roster, not a hunt.

Snippet
repo: example-labs/notes
commit: abc123
author email: lab-old@example.net
write: commit field
employment: not confirmed here
not: a staff roster, and not a search for the person

Diagram

Keep a commit email inside the commit

  1. Repository

    The public repo you were allowed to review.

    Source
    example-labs/notes
  2. Commit

    The id that holds the string.

    Id
    abc123
  3. Author email

    The field as printed.

    Field
    lab-old@example.net
  4. Stop

    No roster entry and no search for a private person.

    Limit
    ask the organization

Check yourself

1. A commit you are allowed to review shows author email lab-old@example.net. What is that?

2. The organization has not confirmed employment. What do you add to the note?

3. Who can say whether the address is a current employee?