Building practical software with intent.

GitHub Secrets Watcher

A command-line tool that scans GitHub repositories (public and private with token) for accidentally committed environment files (.env, config files with secrets, etc.) in the Git history and reports findings (read-only, no modifications). Features include multi-threaded scanning, configurable output formats (text, JSON, CSV), and direct links to exact commits.

• Scans public and private repositories (with token) for a given GitHub username
• Checks Git history for environment/configuration files across multiple branches (configurable depth)
• Excludes common directories (node_modules, .git, dist, etc.) to reduce noise
• Provides direct links to exact commits where each file appears (URL-encoded for safety)
• Validates commit hash format (40 hex characters) to prevent broken links
• Read-only operations only - performs no modifications to any repositories
• Optional GitHub token for higher API rate limits and access to private repositories
• Multi-threaded repository scanning for improved performance (configurable thread count)
• Configurable output formats: human-readable text, machine-readable JSON, or CSV
• Colored terminal output for better readability (ANSI colors, Windows VT processing enabled)