Tools · Ethical OSINT and privacy self-defense · 08 / 17
Searching public code for your organization’s leaked secrets and internal hostnames
Search public repositories for your domains, internal hostnames, and key prefixes, triage hits without using any credentials you find, and coordinate rotation and removal.
Where leaks happen
Employees and contractors sometimes push configuration files, scripts, or notebooks to personal public repositories. These can contain internal hostnames, API keys, connection strings, or customer data. Searching public code for your own identifiers finds them before others do.
What to search for
Your domains and internal hostnames, unique strings from your configuration such as an internal project code name, and key prefixes for services you use combined with your domain. GitHub code search supports qualifiers such as path, language, and exact phrases.
"corp.example.org" "example.org" path:*.env "jdbc:postgresql://db.corp.example.org" "example.org" (AKIA OR "xoxb-" OR "ghp_") org:example-org path:.github/workflows "secrets."
Lab: triage a hit safely
Search for your own personal domain or an organization domain you are authorized to review. For each hit, record the repository, file, commit, and what is exposed. Do not test whether a credential works: using found credentials is unauthorized access even when the account is yours to protect. Hand the finding to the credential owner, who rotates it and checks logs. Then contact the repository owner or use the platform’s reporting process to have the content removed.
Prevention
Enable secret scanning and push protection on your organization’s repositories, offer a clear internal channel for reporting accidental leaks without blame, and give developers a secret manager that is easier to use than pasting keys into files.
Diagram
Unsafe versus safe handling of a found secret
Never use what you find.
Action. Test the key to see if it works
Legal risk. Unauthorized access
Outcome. Evidence muddied, possible harm
Action. Report to the owner for rotation
Legal risk. None
Outcome. Key revoked; logs checked; content removed
Check yourself
1. You find what looks like your company’s API key in a public repository. What should you do?
2. Which search term is most useful for finding internal leaks?
3. Which control stops many leaks before they are pushed?