# tillson/git-hound

Fast GitHub recon tool. Scans for leaked secrets across all of GitHub, not just known repos and orgs. Support for GitHub dorks.

Repository: https://github.com/tillson/git-hound
Canonical: https://ross.abutalabs.com/products/git-hound
Homepage: http://githoundexplore.com/
Language: Go
License: MIT
License Family: permissive
Topics: osint, security-tools, security, secrets, bugbounty, leaks, recon, credentials, devsecops, scanning, secret, secret-management
Last push: 2026-02-10T00:32:15+00:00

## Health v2 (maintenance only)
Score: 70/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 66, release rhythm 57, longevity 100
- inputs: {"age_days": 2605, "days_push": 205, "days_rel": 287, "gap_med": 4.5, "n_releases_24m": 7}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1451, forks 204 (observed 2026-08-28T04:04:46.089924+00:00)

## What it is
GitHound is a Go-based CLI tool that hunts for exposed API keys, secrets, and credentials across all of GitHub using GitHub dorks, pattern matching, entropy analysis, and commit-history digging. It leverages GitHub's Code Search API to scan all public repositories and Gists, with JSON output and custom regex rules for automation pipelines.

## Use cases
- find leaked API keys on GitHub
- scan GitHub for exposed credentials
- search commit history for deleted secrets
- run GitHub dorks to find sensitive files
- monitor GitHub for leaked secrets in bug bounty recon
- extract base64-encoded secrets from GitHub code

## When to choose
- you need org-wide GitHub secret recon beyond specific repos
- you want to dig through commit history for reverted credentials
- you need JSON output for automated security pipelines
- you're doing bug bounty or OSINT reconnaissance on GitHub

## When to avoid
- you only need to scan your own private repos locally
- you need a full secret-management vault rather than a scanner
- you can't provide a GitHub API token
- you need real-time pre-commit secret prevention rather than post-leak detection

## Facets
- artifact type: cli-tool
- maturity: active
- function: osint, security, search-engine, cli
- domain: security, osint, developer-tools, penetration-testing
- platform: windows, cli, cross-platform
- tags: secret-scanning, github-dorks, bug-bounty, recon, leaked-credentials, commit-history-analysis, linux, macos

## Member repositories
- tillson/git-hound (main) score 70

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:46.089924+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:35:53.133401+00:00, confidence not recorded.
  - readme: https://github.com/tillson/git-hound (fetched 2026-08-28T04:04:46.089924+00:00, sha 876be5c9fe9f)
  - homepage: http://githoundexplore.com/ (fetched 2026-08-29T11:45:20.163695+00:00, sha 990642ad2371)
- Data as of 2026-08-30T08:39:29.467469+00:00.