Point it at a GitHub account and it walks every public repository looking for
things that should never have been committed: .env files, private keys, cloud
credentials, keystores and the like.
pip install -e .
gitprowl acme-corp --token $GITHUB_TOKEN
Findings come in two flavours. Filename signatures flag files that shouldn't be
in a repo at all (.env, id_rsa, *.pem, .aws/credentials). Content
signatures read text files and match provider token shapes (AWS keys, GitHub
PATs, Slack tokens, private-key blocks). Matched secrets are redacted to their
first few characters before they are printed.
Output is one line per finding, sorted by severity:
[critical] acme-corp/infra: deploy/id_rsa - private ssh key
[critical] acme-corp/api: settings.py - github personal access token (ghp_****)
[ high] acme-corp/web: config/.env - environment file with secrets
3 finding(s) across 14 repo(s)
Pass --json for machine-readable output, --no-content to match filenames
only, --entropy to also flag high-randomness strings that no signature knows
about (noisier, but catches unknown key formats), and --include-forks to
widen the sweep.
A token is optional but the unauthenticated rate limit (60 requests/hour) runs
out fast, so pass --token or set GITHUB_TOKEN.
I kept wanting a small, current version of the old GitHub recon tools for checking my own org's footprint before an audit. This started as a weekend rewrite and grew from there.
The idea owes a lot to gitrob, which popularised scanning an org's public repos for sensitive files and has been archived since 2022. gitprowl is a clean-room reimplementation in Python, not a fork: no code was carried over. The signature set and the content/entropy passes were written from scratch and modernised for today's token formats.
Only public data is read, and only for accounts you are allowed to assess. Use it on your own footprint or with permission.
MIT