// the find
hisxo/gitGraber
gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...
gitGraber scans GitHub's recently-indexed files for leaked API keys and credentials, alerting you via Slack, Discord, or Telegram when it finds matches. It's a monitoring tool, not a historical scanner — it watches the GitHub search feed in near-real-time. The target audience is bug bounty hunters and red teamers doing continuous credential leak monitoring for specific organizations or keywords.
The focus on real-time indexing rather than historical git history is a genuinely different niche from tools like truffleHog or gitleaks, and it fills it well. The 31-token regex library in tokens.py covers the major services with false-positive blacklisting built into the Token class, which shows real-world operational experience. Rate limit handling across multiple GitHub tokens is practical — abuse detection is the first thing that kills tools like this in production, and they actually thought about it. The combo-check module for services like Twilio that require two tokens together to be useful is a nice detail.
The last meaningful update was 2019 according to the README's own timestamp, and it shows: no async/threading (explicitly listed as TODO), results deduplication is done with a flat text file (rawGitUrls.txt) rather than anything that survives restarts cleanly, and the cron-based monitoring via -m flag is a hack rather than a proper daemon. The GitHub Search API has changed significantly since 2019 and several token patterns for services like Stripe and Slack have been deprecated or updated, so expect false negatives out of the box. Config lives in config.py as hardcoded strings, so if you're running this anywhere near CI or a shared server, your webhook URLs and GitHub tokens are just sitting in a Python file.