boringtools / git-alerts

Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files

GitAlerts

What problem does it solve?

GitHub repositories created under any organization can be controlled by the GitHub administrators. However any repository created under an organization's user account is not controllable unless the organisation has adopted the GitHub enterprise-managed user (EMU) model.

Any public repository under the organization's user account that was created accidentally or for testing purposes could leak secrets, internal information, code etc. GitAlerts helps you detect and monitor such cases

Example

Can be controlled by the administrator https://github.com/<org>/<org-repo-name>

Can't be controlled by the administrator https://github.com/<org-user>/<org-user-repo-name>

Getting Started

• Download the binary file for your operating system / architecture from the Official GitHub Releases

• You can also install git-alerts using homebrew in MacOS and Linux

brew tap boringtools/tap
brew install boringtools/tap/git-alerts

• Alternatively, build from source

Ensure $(go env GOPATH)/bin is in your $PATH

go install github.com/boringtools/git-alerts@main

Setup GitHub personal access token (PAT) as the environment variable, without PAT GitHub will only allow 60 request per hour.

export GITHUB_PAT=YOUR_GITHUB_PAT

Usage

Scan GitHub repositories belonging to your organization users

git-alerts scan --org your-org-name

Monitor new public repositories being created by your organization users

git-alerts monitor --org your-org-name

Monitor new public repositories being created by your organization users with slack notification

git-alerts monitor --org your-org-name --slack-alert

Setup slack webhook token as the environment variable

export SLACK_HOOK=SLACK_WEBHOOK_URL

Scan and generate report with custom path

git-alerts scan --org your-org-name --report-path /your/file/path/

Scan with secrets detection using Trufflehog

Ensure trufflehog is installed in your machine

git-alerts detect --org your-org-name

Documentation

docs

Please feel to reach out for any feedback and suggestions

Star History

git-alerts's Issues

Scan results summery

Current State

git-alerts scan does not provide a short summary of the number of repositories detected after the scan is completed.

Proposed Improvements

Support a short summary with the repository states at the end of the scan.

Allow scan public repos without PAT

Hello,

Awesome tool!

It would be great if scanning/monitoring for public repos will not require GITHUB_PAT.

Webhooks!

Would be great if you had a webhook integration so that I could integrate your tool beyond Slack :)

password not found

Hi, i tried git-alerts detect --org command which didn't find any secrets.

Incremental detection of new GitHub repositories

Current State

git-alerts detects public GitHub repositories in one scan that do not show newly created repositories in subsequent scans.

Proposed Improvements

Support incremental detection of newly created public repositories so git-alerts can be used in a monitoring mode to alert for new public repositories. It would also help running git-alerts in CI pipeline.