Identifying API, Tokens, Credentials and Secrets Keys from Github Private and Public Repositories
TL;DR
The tool orchestrates established utility engines specifically Git, TruffleHog, and Notify into a cohesive pipeline incorporating member account enumeration, parallel repository downloads, temporal commit filtering, and active token validation, and its integration within corporate DevSecOps pipelines is discussed.
Abstract
Credential leakage in version control systems exposes enterprise software ecosystems to rapid automated exploitation. This paper presents gitxpose, a Go-based command-line tool for automated repository discovery and secret scanning. The tool orchestrates established utility engines specifically Git, TruffleHog, and Notify into a cohesive pipeline incorporating member account enumeration, parallel repository downloads, temporal commit filtering, and active token validation. In our experimental evaluation across 545 target repositories, gitxpose identified 710 unique secrets, representing an average repository compromise rate of 24.99%. Member-based scanning returned the highest compromise rate at 34.50%, demonstrating severe security exposures in employee-affiliated personal repositories. We analyze the orchestrator's multi-threaded architecture, compare its capabilities against existing tools, and discuss its integration within corporate DevSecOps pipelines.