Automated Public Repository Recon: Hunting Exposed API Keys, Cloud Credentials & Codebase Leaks

Learn how to hunt and remediate exposed credentials, AWS secrets, private keys, and config leaks in public GitHub repositories using automated intelligence tools.

Public code repositories are one of the richest goldmines for intelligence analysts and threat actors alike. Over 10 million unique secrets—including AWS access keys, Stripe tokens, OpenAI API keys, database connection URIs, and private SSH certificates—are committed to public GitHub repositories every year.

1. Top 10 GitHub Search Dorks for Secret Reconnaissance

Use these precision queries (replacing {company} with your target organization) to audit exposed attack surfaces:

# 1. AWS Secret Keys
org:{company} "AWS_SECRET_ACCESS_KEY" filename:.env

# 2. Stripe Secret Keys (Live Production)
org:{company} "sk_live_" filename:config

# 3. Private RSA / SSH Keys
org:{company} "BEGIN RSA PRIVATE KEY" extension:pem

# 4. Database Connection Strings with Passwords
org:{company} "mongodb+srv://" OR "postgres://" filename:.env

# 5. OpenAI & Anthropic API Keys
org:{company} "sk-proj-" OR "sk-ant-api" extension:json

# 6. JSON Web Token (JWT) Secrets
org:{company} "JWT_SECRET" OR "SECRET_KEY_BASE"

# 7. Slack & Discord Webhook URLs
org:{company} "https://hooks.slack.com/services/"

# 8. Staging & Internal Credentials
org:{company} "staging.internal" password

# 9. Kubernetes & Docker Configs with Auth Tokens
org:{company} filename:kubeconfig "client-certificate-data"

# 10. SSH Config & Known Hosts
org:{company} filename:id_rsa OR filename:known_hosts

2. Automated Secret Scanning with TruffleHog & Gitleaks

Run automated high-entropy scanning against your repositories before deploying to production:

# Run TruffleHog against verified git history:
trufflehog github --org={company} --only-verified

# Run Gitleaks in CI/CD pipeline:
gitleaks detect --source=. --verbose --redact

Frequently asked questions

How do API keys and secrets get accidentally leaked to GitHub?

Developers frequently commit .env files, hardcode JWT secrets into test scripts, push staging database connection strings, or commit credentials in earlier git commits that remain accessible in git history even after being deleted in the latest commit.

What is git history archaeology in secret reconnaissance?

Git preserves every commit object and tree diff. Automated tools scan the entire git reflog and commit history (e.g., via Trufflehog or Gitleaks) to extract high-entropy strings and known regex patterns from commits made months or years ago.

What are GitHub Dorks?

GitHub search dorks are precision search syntax operators (e.g., 'org:company filename:.env AWS_SECRET_ACCESS_KEY') used to surface exposed sensitive files across all public repositories belonging to an organization or its developers.

What immediate steps must an organization take upon discovering a leaked key?

1. Immediately revoke and rotate the credential at the provider, 2. Inspect cloud audit logs (CloudTrail, Stripe Logs) for unauthorized API calls, and 3. Rewrite git history using git-filter-repo or BFG Repo-Cleaner before force-pushing.