Wide Source-Code Search
Map public code, configuration, packages, history, and documentation tied to an authorized organization.
On this page · 5 sections
Map organizations, users & repositories
Begin with known organization names, verified domains, developer portals, package namespaces, and repository links from official properties. Similar names alone do not establish ownership.
- Official GitHub organizations and verified domains.
- Known maintainers and service accounts.
- Public repositories, forks, archived projects, and templates.
- Package namespaces for npm, PyPI, Maven, NuGet, RubyGems, and containers.
- Documentation, examples, issue trackers, and CI/CD references.
Layered search strategy
- 01
Search narrow organization or repository scope first.
- 02
Look for domain names, internal hostnames, project codenames, and configuration vocabulary.
- 03
Add path, language, and filename qualifiers.
- 04
Review forks, archived repositories, and commit history when authorized.
- 05
Correlate a result with the deployed asset inventory before escalating.
org:example-corp "example.com"
org:example-corp path:.github/workflows
org:example-corp (path:.env OR path:config) NOT path:test
repo:example-corp/sample language:yaml "endpoint"High-value source surfaces
| Surface | Look for | Defensive control |
|---|---|---|
| CI/CD | Workflow permissions, environments, artifact paths | Least privilege and protected environments |
| Configuration | Endpoints, tenant IDs, feature flags | Separate public config from secrets |
| Infrastructure as code | Public resources and trust relationships | Policy-as-code and review |
| Packages | Namespaces, install scripts, ownership | Provenance and publisher controls |
| History | Removed sensitive values and old endpoints | Secret rotation and history cleanup |
Authorized query builder
Use the client-side builder below to compose GitHub Code Search qualifiers. The query stays in this browser until you choose to open GitHub.
Enter a valid authorized scope to build a query.The query is assembled locally. This site does not receive search results, credentials, or repository data.
Evidence & remediation
PUBLIC URL:
OWNER / SCOPE EVIDENCE:
FILE / COMMIT:
EXPOSED DATA CLASS:
SECRET STATUS: unknown / revoked / active (owner-confirmed)
AFFECTED SYSTEM:
ROTATION / REMOVAL OWNER:
DISCOVERY DATE: