gitghost // exposure dossier
FILED 2026-07-01 21:42 UTC
1 public repo scanned
Subject of report
@billing-service
Public repositories only. Detection-only: no discovered credential was ever tested against its provider.
CRITICAL
Exposure Score
95/100
Grade F · higher is worse · worst find: AWS Secret Access Key (ghost)

What's driving this score

Recovered from history

The secrets you deleted didn't leave.

4 secrets removed from the current code but still reachable in git history. To anyone who clones the repo, these are one command away.

10 AWS Secret Access Key 65 chars · fp:376167013c (history) entered 2024-03-12 1fd51e33d6
Rotate the secret key and audit CloudTrail for use since the commit date.
9 AWS Access Key ID AKIA… 20 chars · fp:1a5d44a2dc (history) entered 2024-03-12 1fd51e33d6
Deactivate the key in IAM immediately, then rotate. Assume it is compromised the moment it touched a public commit.
8 Database Connection String 48 chars · fp:c6bd0e9ab1 (history) entered 2024-03-12 1fd51e33d6
Rotate the database password; the credential and host are both exposed.
2 Internal Hostname 11 chars · fp:5e59793240 (history) entered 2024-03-12 1fd51e33d6
Scrub internal DNS names from committed config; they reveal network topology.
Live in current code

6 secrets sitting in HEAD right now.

9 Private Key Block 31 chars · fp:8bcac7908e id_rsa:1
Treat the key pair as burned. Generate a new pair and rotate every place the public key was trusted.
9 Stripe Secret Key sk_live_… 32 chars · fp:78a08441f4 deploy/ci.sh:2
Roll the key in the Stripe dashboard; check for unexpected charges.
8 GitHub Personal Access Token ghp_… 40 chars · fp:554ff9d922 deploy/ci.sh:3
Revoke the token under GitHub Settings > Developer settings > Tokens.
6 High-Entropy Secret (generic) 44 chars · fp:2d452b67e7 .env:1
Confirm whether this is a real credential; if so rotate and move it to a secret manager.
6 High-Entropy Secret (generic) 40 chars · fp:e684776e13 .env:2
Confirm whether this is a real credential; if so rotate and move it to a secret manager.
4 Slack Incoming Webhook 77 chars · fp:f5c388734d deploy/ci.sh:4
Delete the webhook; anyone with the URL can post to the channel.
Infrastructure breadcrumbs
2 Internal Hostname 11 chars · fp:5e59793240 README.md:2
Scrub internal DNS names from committed config; they reveal network topology.
2 Internal Hostname 11 chars · fp:5e59793240 (history) entered 2024-03-12 1fd51e33d6
Scrub internal DNS names from committed config; they reveal network topology.
1 Hardcoded Private IP 9 chars · fp:344a258f3c README.md:2
Move host addresses to environment config rather than source.
What your commits reveal about you
Author email
dana.rivera@gmail.com
Timezone (inferred)
+0530
Active hours (inferred)
21:00–21:00 (local)
Commits analyzed
5
gitghost — an exposure audit built from public data. It surfaces and scores what a GitHub identity already published, including material believed deleted but still recoverable from git history.
It is detection-only by design: it reports that a string matches a credential format and stops. It never authenticates with a discovered secret, never touches private repositories, and is meant for auditing your own identity or one you're authorized to assess.
Every finding is shown as a non-reversible fingerprint (a safe prefix, a length, and a partial hash) — never recoverable key material — so this report is safe to share. gitghost does not retain the raw secret past the match.