gitghost-scanner 1.2.0__py3-none-any.whl

gitghost/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.2.0"

gitghost/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+main()

gitghost/banner.py

@@ -0,0 +1,38 @@
+import sys
+
+from . import __version__
+
+_ART = r"""
+   ____ _(_) /_____ _/ /_  ____  _____/ /_
+  / __ `/ / __/ __ `/ __ \/ __ \/ ___/ __/
+ / /_/ / / /_/ /_/ / / / / /_/ (__  ) /_
+ \__, /_/\__/\__, /_/ /_/\____/____/\__/
+/____/      /____/
+"""
+
+_GHOST = r"""      .-.
+     (o o)
+     | O |
+      \_/
+"""
+
+
+def banner():
+    if not sys.stdout.isatty():
+        return ""
+    orange, dim, ghost_c, reset = "\033[38;5;208m", "\033[2m", "\033[38;5;250m", "\033[0m"
+    art = _ART.strip("\n").splitlines()
+    ghost = _GHOST.strip("\n").splitlines()
+    width = max(len(l) for l in art) + 4
+    out = []
+    for i, line in enumerate(art):
+        g = ghost[i] if i < len(ghost) else ""
+        out.append(orange + line.ljust(width) + reset + ghost_c + g + reset)
+    tag = f"{dim}  the secrets you deleted are still in git history{reset}   {orange}v{__version__}{reset}"
+    return "\n".join(out) + "\n" + tag + "\n"
+
+
+def print_banner():
+    b = banner()
+    if b:
+        print(b)

gitghost/cli.py

@@ -0,0 +1,123 @@
+import argparse
+import sys
+import tempfile
+
+from . import github
+from .ghost import recover_ghosts
+from .metadata import analyze_metadata
+from .report import render_report
+from .rules import Finding
+from .scanner import scan_repo
+from .score import compute_score
+
+
+def _scan_one(root: str, name: str) -> tuple[list[Finding], object]:
+    findings = list(scan_repo(root, name).findings)
+    findings += recover_ghosts(root, name)
+    meta = analyze_metadata(root)
+    return findings, meta
+
+
+def run_local(path: str, name: str, out: str) -> None:
+    print(f"[*] scanning local repo: {name}")
+    findings, meta = _scan_one(path, name)
+    card = compute_score(findings, meta)
+    _emit(name, card, findings, meta, 1, out)
+
+
+def run_repo(url: str, out: str) -> None:
+    try:
+        repo = github.repo_from_url(url)
+    except ValueError as e:
+        sys.exit(f"[!] {e}")
+    print(f"[*] scanning single repo: {repo.full_name}")
+    with tempfile.TemporaryDirectory() as tmp:
+        dest = github.clone(repo, tmp)
+        if not dest:
+            sys.exit(f"[!] could not clone {repo.clone_url} (private, renamed, or network issue)")
+        findings, meta = _scan_one(dest, repo.name)
+        for finding in findings:
+            finding.repo_url = repo.html_url
+        card = compute_score(findings, meta)
+        _emit(repo.full_name, card, findings, meta, 1, out)
+
+
+def run_identity(identity: str, limit: int, out: str) -> None:
+    print(f"[*] enumerating public repos for @{identity} ...")
+    try:
+        repos = github.list_public_repos(identity, limit=limit)
+    except Exception as e:
+        sys.exit(f"[!] could not reach GitHub API: {e}\n    (set GITHUB_TOKEN to raise rate limits)")
+    if not repos:
+        sys.exit(f"[!] no public repos found for @{identity}")
+    print(f"[*] {len(repos)} repos. cloning + scanning (history included for ghost recovery)...")
+
+    all_findings: list[Finding] = []
+    merged_meta = None
+    with tempfile.TemporaryDirectory() as tmp:
+        for r in repos:
+            dest = github.clone(r, tmp)
+            if not dest:
+                print(f"    - skip {r.name} (clone failed)")
+                continue
+            f, m = _scan_one(dest, r.name)
+            for finding in f:
+                finding.repo_url = r.html_url
+            all_findings += f
+            merged_meta = _merge_meta(merged_meta, m)
+            tag = f"{len([x for x in f if x.kind=='secret' and not x.is_ghost])} live / {len([x for x in f if x.is_ghost])} ghost"
+            print(f"    - {r.name:<32} {tag}")
+
+    card = compute_score(all_findings, merged_meta)
+    _emit(identity, card, all_findings, merged_meta, len(repos), out)
+
+
+def _merge_meta(a, b):
+    if a is None:
+        return b
+    for e in b.emails:
+        if e not in a.emails:
+            a.emails.append(e)
+    a.commit_count += b.commit_count
+    a.dominant_utc_offset = a.dominant_utc_offset or b.dominant_utc_offset
+    a.likely_active_hours = a.likely_active_hours or b.likely_active_hours
+    return a
+
+
+def _emit(identity, card, findings, meta, repos_scanned, out):
+    html = render_report(identity, card, findings, meta, repos_scanned)
+    with open(out, "w", encoding="utf-8") as f:
+        f.write(html)
+    print(f"\n[=] EXPOSURE SCORE: {card.score}/100  [{card.band}]  grade {card.grade}")
+    for d in card.drivers:
+        print(f"    · {d}")
+    print(f"[=] dossier written to: {out}")
+
+
+def main() -> None:
+    p = argparse.ArgumentParser(prog="gitghost", description="GitHub exposure dossier (detection-only).")
+    from . import __version__
+    p.add_argument("--version", action="version", version=f"gitghost {__version__}")
+    p.add_argument("identity", nargs="?", help="GitHub username or org")
+    p.add_argument("--repo", help="scan a single repo by URL or owner/name")
+    p.add_argument("--local", help="scan a repo already on disk instead of GitHub")
+    p.add_argument("--name", default="local-repo", help="label for --local scans")
+    p.add_argument("--limit", type=int, default=30, help="max repos to scan")
+    p.add_argument("--out", default="gitghost-dossier.html", help="output HTML path")
+    args = p.parse_args()
+
+    from .banner import print_banner
+    print_banner()
+
+    if args.local:
+        run_local(args.local, args.name, args.out)
+    elif args.repo:
+        run_repo(args.repo, args.out)
+    elif args.identity:
+        run_identity(args.identity, args.limit, args.out)
+    else:
+        p.error("provide a GitHub username, --repo <url>, or --local <path>")
+
+
+if __name__ == "__main__":
+    main()

gitghost/ghost.py

@@ -0,0 +1,81 @@
+import re
+import subprocess
+
+
+from .rules import Finding, scan_text
+
+
+def _git(root: str, *args: str) -> str:
+    return subprocess.run(
+        ["git", "-C", root, *args],
+        capture_output=True, text=True, errors="ignore",
+    ).stdout
+
+
+def _head_blobs(root: str) -> set[str]:
+    out = _git(root, "ls-tree", "-r", "HEAD")
+    blobs = set()
+    for line in out.splitlines():
+        parts = line.split()
+        if len(parts) >= 3 and parts[1] == "blob":
+            blobs.add(parts[2])
+    return blobs
+
+
+def _all_historical_blobs(root: str) -> list[tuple[str, str]]:
+    seen: dict[str, str] = {}
+    for line in _git(root, "rev-list", "--all", "--objects").splitlines():
+        parts = line.split(maxsplit=1)
+        if len(parts) == 2 and len(parts[0]) == 40:
+            seen.setdefault(parts[0], parts[1])
+
+    for line in _git(root, "fsck", "--unreachable", "--no-reflogs").splitlines():
+        parts = line.split()
+        if len(parts) == 3 and parts[1] == "blob":
+            seen.setdefault(parts[2], "")
+    return list(seen.items())
+
+
+_VENDOR = re.compile(r"(^|/)(node_modules|vendor|dist|build|\.next|bower_components|"
+                     r"third_party|site-packages|\.venv|venv)/|"
+                     r"(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|"
+                     r"\.min\.js|\.min\.css|\.map)$", re.I)
+
+
+def _introducing_commit(root: str, blob: str) -> tuple[str, str]:
+    out = _git(root, "log", "--all", "--format=%H|%ci", "--find-object", blob, "--reverse")
+    for line in out.splitlines():
+        if "|" in line:
+            h, date = line.split("|", 1)
+            return h[:10], date.strip()[:10]
+    return "dangling", "unknown"
+
+
+def recover_ghosts(root: str, repo_name: str, max_blobs: int = 4000) -> list[Finding]:
+    head = _head_blobs(root)
+    ghosts: list[Finding] = []
+    seen_fp: set[tuple] = set()
+    checked = 0
+    for blob, path in _all_historical_blobs(root):
+        if blob in head:
+            continue
+        if path and _VENDOR.search(path):
+            continue
+        if checked >= max_blobs:
+            break
+        checked += 1
+        content = _git(root, "cat-file", "-p", blob)
+        if not content:
+            continue
+        for f in scan_text(content):
+            key = (f.rule_id, f.redacted)
+            if key in seen_fp:
+                continue
+            seen_fp.add(key)
+            commit, date = _introducing_commit(root, blob)
+            f.repo = repo_name
+            f.is_ghost = True
+            f.commit = commit
+            f.path = f"(history) entered {date}"
+            ghosts.append(f)
+    return ghosts

gitghost/github.py

@@ -0,0 +1,80 @@
+import json
+import os
+import subprocess
+
+import urllib.request
+from dataclasses import dataclass
+
+
+API = "https://api.github.com"
+
+
+@dataclass
+class Repo:
+    name: str
+    full_name: str
+    clone_url: str
+    pushed_at: str
+    html_url: str = ""
+
+
+def _get(url: str) -> list | dict:
+    req = urllib.request.Request(url, headers={
+        "Accept": "application/vnd.github+json",
+        "User-Agent": "gitghost",
+    })
+    token = os.environ.get("GITHUB_TOKEN")
+    if token:
+        req.add_header("Authorization", f"Bearer {token}")
+    with urllib.request.urlopen(req, timeout=30) as r:
+        return json.loads(r.read().decode())
+
+
+def list_public_repos(identity: str, limit: int = 30) -> list[Repo]:
+    repos: list[Repo] = []
+    page = 1
+    while len(repos) < limit:
+
+        data = _get(f"{API}/users/{identity}/repos?per_page=100&page={page}&sort=pushed")
+        if not isinstance(data, list) or not data:
+            break
+        for d in data:
+            if d.get("fork"):
+                continue
+            repos.append(Repo(
+                name=d["name"], full_name=d["full_name"],
+                clone_url=d["clone_url"], pushed_at=d.get("pushed_at", ""),
+                html_url=d.get("html_url", ""),
+            ))
+            if len(repos) >= limit:
+                break
+        page += 1
+    return repos
+
+
+def repo_from_url(url: str) -> Repo:
+    u = url.strip().rstrip("/")
+    if u.endswith(".git"):
+        u = u[:-4]
+
+    for prefix in ("https://github.com/", "http://github.com/", "git@github.com:", "github.com/"):
+        if u.startswith(prefix):
+            u = u[len(prefix):]
+            break
+    parts = u.split("/")
+    if len(parts) < 2:
+        raise ValueError(f"not a valid repo reference: {url!r} (expected owner/name or a GitHub URL)")
+    owner, name = parts[0], parts[1]
+    full = f"{owner}/{name}"
+    return Repo(name=name, full_name=full,
+                clone_url=f"https://github.com/{full}.git",
+                pushed_at="", html_url=f"https://github.com/{full}")
+
+
+def clone(repo: Repo, dest_parent: str) -> str | None:
+    dest = os.path.join(dest_parent, repo.name)
+    r = subprocess.run(
+        ["git", "clone", "--quiet", repo.clone_url, dest],
+        capture_output=True, text=True,
+    )
+    return dest if r.returncode == 0 else None

gitghost/metadata.py

@@ -0,0 +1,52 @@
+import re
+import subprocess
+from collections import Counter
+from dataclasses import dataclass, field
+
+
+@dataclass
+class MetadataReport:
+    emails: list[str] = field(default_factory=list)
+    noreply_emails: list[str] = field(default_factory=list)
+    dominant_utc_offset: str | None = None
+    likely_active_hours: str | None = None
+    commit_count: int = 0
+
+
+_NOREPLY = re.compile(r"noreply|users\.noreply\.github\.com", re.I)
+
+
+def analyze_metadata(root: str) -> MetadataReport:
+    out = subprocess.run(
+        ["git", "-C", root, "log", "--all", "--format=%ae|%ai"],
+        capture_output=True, text=True, errors="ignore",
+    ).stdout
+
+    emails: Counter[str] = Counter()
+    offsets: Counter[str] = Counter()
+    hours: Counter[int] = Counter()
+    count = 0
+
+    for line in out.splitlines():
+        if "|" not in line:
+            continue
+        email, ts = line.split("|", 1)
+        count += 1
+        emails[email.strip()] += 1
+
+        m = re.search(r"(\d{2}):\d{2}:\d{2}\s([+-]\d{4})", ts)
+        if m:
+            hours[int(m.group(1))] += 1
+            offsets[m.group(2)] += 1
+
+    report = MetadataReport(commit_count=count)
+    for email, _ in emails.most_common():
+        (report.noreply_emails if _NOREPLY.search(email) else report.emails).append(email)
+
+    if offsets:
+        report.dominant_utc_offset = offsets.most_common(1)[0][0]
+    if hours:
+        top = [h for h, _ in hours.most_common(6)]
+        lo, hi = min(top), max(top)
+        report.likely_active_hours = f"{lo:02d}:00–{hi:02d}:00 (local)"
+    return report

gitghost/report.py

@@ -0,0 +1,272 @@
+import html
+from datetime import datetime, timezone
+
+from .metadata import MetadataReport
+from .rules import Finding
+from .score import ScoreCard
+
+_BAND_ANGLE = {"CRITICAL": -8, "HIGH": -6, "MODERATE": -4, "LOW": -3, "MINIMAL": -2}
+
+
+def _esc(s: str) -> str:
+    return html.escape(str(s))
+
+
+def _link(url: str, text: str) -> str:
+    return f'<a href="{_esc(url)}" target="_blank" rel="noopener">{text}</a>'
+
+
+def _finding_row(f: Finding) -> str:
+    tone = "ghost" if f.is_ghost else "live"
+    repo_tag = f'<span class="repo">{_esc(f.repo)}</span> ' if f.repo else ""
+
+    if f.is_ghost:
+        loc_text = _esc(f.path) if f.path else ""
+        if f.repo_url and f.commit and f.commit != "dangling":
+            commit_html = _link(f"{f.repo_url}/commit/{f.commit}", _esc(f.commit))
+        elif f.commit:
+            commit_html = f'<span class="commit">{_esc(f.commit)}</span>'
+        else:
+            commit_html = ""
+        loc = f"{loc_text} {commit_html}"
+    else:
+        pathline = f"{_esc(f.path)}:{f.line_no}"
+        if f.repo_url and f.path:
+
+            loc = _link(f"{f.repo_url}/blob/HEAD/{f.path}#L{f.line_no}", pathline)
+        else:
+            loc = pathline
+
+    return f"""
+      <tr class="frow {tone}">
+        <td class="sev"><span class="sev-dot s{f.severity}">{f.severity}</span></td>
+        <td class="lbl">{_esc(f.label)}</td>
+        <td class="val"><code class="redaction">{_esc(f.redacted)}</code></td>
+        <td class="loc">{repo_tag}{loc}<div class="rem">{_esc(f.remediation)}</div></td>
+      </tr>"""
+
+
+def render_report(identity: str, card: ScoreCard, findings: list[Finding],
+                  meta: MetadataReport, repos_scanned: int) -> str:
+    live = sorted((f for f in findings if f.kind == "secret" and not f.is_ghost),
+                  key=lambda f: -f.severity)
+    ghosts = sorted((f for f in findings if f.is_ghost), key=lambda f: -f.severity)
+    infra = sorted((f for f in findings if f.kind == "infra"), key=lambda f: -f.severity)
+
+    ts = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+    angle = _BAND_ANGLE.get(card.band, -6)
+
+    meter_pct = card.score
+    drivers = "".join(f"<li>{_esc(d)}</li>" for d in card.drivers) or "<li>Nothing notable surfaced. Rare, and good.</li>"
+
+    ghost_section = ""
+    if ghosts:
+        ghost_section = f"""
+        <section class="block ghost-block">
+          <div class="block-head">
+            <span class="eyebrow">Recovered from history</span>
+            <h2>The secrets you deleted didn't leave.</h2>
+            <p class="note">{len(ghosts)} secret{'s' if len(ghosts)!=1 else ''} removed from the current code but still reachable in git history. To anyone who clones the repo, these are one command away.</p>
+          </div>
+          <table class="findings"><tbody>{''.join(_finding_row(f) for f in ghosts)}</tbody></table>
+        </section>"""
+
+    live_section = ""
+    if live:
+        live_section = f"""
+        <section class="block">
+          <div class="block-head">
+            <span class="eyebrow hot">Live in current code</span>
+            <h2>{len(live)} secret{'s' if len(live)!=1 else ''} sitting in HEAD right now.</h2>
+          </div>
+          <table class="findings"><tbody>{''.join(_finding_row(f) for f in live)}</tbody></table>
+        </section>"""
+
+    infra_section = ""
+    if infra:
+        infra_section = f"""
+        <section class="block">
+          <div class="block-head"><span class="eyebrow">Infrastructure breadcrumbs</span></div>
+          <table class="findings"><tbody>{''.join(_finding_row(f) for f in infra)}</tbody></table>
+        </section>"""
+
+    emails = ", ".join(_esc(e) for e in meta.emails[:3]) or "none exposed"
+    meta_section = f"""
+    <section class="block">
+      <div class="block-head"><span class="eyebrow">What your commits reveal about you</span></div>
+      <div class="meta-grid">
+        <div class="meta-cell"><div class="mk">Author email</div><div class="mv">{emails}</div></div>
+        <div class="meta-cell"><div class="mk">Timezone (inferred)</div><div class="mv">{_esc(meta.dominant_utc_offset or '—')}</div></div>
+        <div class="meta-cell"><div class="mk">Active hours (inferred)</div><div class="mv">{_esc(meta.likely_active_hours or '—')}</div></div>
+        <div class="meta-cell"><div class="mk">Commits analyzed</div><div class="mv">{meta.commit_count:,}</div></div>
+      </div>
+    </section>"""
+
+    return f"""<!DOCTYPE html>
+<html lang="en"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>gitghost dossier — {_esc(identity)}</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link href="https://fonts.googleapis.com/css2?family=Archivo:wght@400;600;800;900&family=Space+Mono:wght@400;700&display=swap" rel="stylesheet">
+<style>
+  :root {{
+    --paper:#E7E4DB; --panel:#F1EEE7; --ink:#17150F; --muted:#8A8577;
+    --hazard:#E4491C; --ghost:#3E5C6B; --line:rgba(23,21,15,.16);
+  }}
+  * {{ box-sizing:border-box; }}
+  body {{ margin:0; background:var(--paper); color:var(--ink);
+    font-family:'Archivo',system-ui,sans-serif; -webkit-font-smoothing:antialiased; }}
+  .sheet {{ max-width:940px; margin:0 auto; padding:40px 28px 80px; }}
+  code, .mono {{ font-family:'Space Mono',monospace; }}
+
+  .top {{ display:flex; justify-content:space-between; align-items:baseline;
+    border-bottom:2px solid var(--ink); padding-bottom:10px; gap:16px; flex-wrap:wrap; }}
+  .brand {{ font-weight:900; letter-spacing:-.02em; font-size:20px; }}
+  .brand b {{ color:var(--hazard); }}
+  .filed {{ font-family:'Space Mono',monospace; font-size:12px; color:var(--muted); text-align:right; }}
+
+  .hero {{ display:grid; grid-template-columns:1.1fr .9fr; gap:28px; margin:34px 0 10px; align-items:center; }}
+  @media(max-width:720px){{ .hero{{ grid-template-columns:1fr; }} }}
+  .target-eyebrow {{ font-family:'Space Mono',monospace; font-size:12px; letter-spacing:.14em;
+    text-transform:uppercase; color:var(--muted); }}
+  .target {{ font-size:clamp(34px,7vw,58px); font-weight:900; letter-spacing:-.03em; line-height:.98; margin:6px 0 14px; word-break:break-word; }}
+  .target span {{ color:var(--hazard); }}
+  .scope {{ font-family:'Space Mono',monospace; font-size:12.5px; color:var(--muted); max-width:40ch; }}
+
+  .scorebox {{ position:relative; background:var(--panel); border:2px solid var(--ink);
+    padding:22px 24px 20px; }}
+  .scorebox .k {{ font-family:'Space Mono',monospace; font-size:11px; letter-spacing:.14em;
+    text-transform:uppercase; color:var(--muted); }}
+  .bignum {{ font-size:96px; font-weight:900; line-height:.86; letter-spacing:-.04em; margin:2px 0 0; }}
+  .bignum small {{ font-size:26px; color:var(--muted); font-weight:600; }}
+  .meter {{ height:12px; background:repeating-linear-gradient(90deg,var(--line) 0 1px,transparent 1px 5%);
+    border:1px solid var(--ink); margin:14px 0 6px; position:relative; }}
+  .meter i {{ position:absolute; inset:0 auto 0 0; width:{meter_pct}%;
+    background:var(--hazard); mix-blend-mode:multiply; }}
+  .stamp {{ position:absolute; top:14px; right:16px; transform:rotate({angle}deg);
+    border:3px double var(--hazard); color:var(--hazard); font-weight:800;
+    font-family:'Space Mono',monospace; letter-spacing:.06em; padding:4px 10px;
+    font-size:15px; opacity:.9; }}
+  .grade {{ font-family:'Space Mono',monospace; font-size:13px; color:var(--muted); margin-top:2px; }}
+  .grade b {{ color:var(--ink); }}
+
+  .drivers {{ background:var(--ink); color:var(--paper); padding:20px 24px; margin:26px 0 8px; }}
+  .drivers h3 {{ margin:0 0 10px; font-size:12px; letter-spacing:.14em; text-transform:uppercase;
+    font-family:'Space Mono',monospace; color:#c9c4b6; font-weight:400; }}
+  .drivers ul {{ margin:0; padding-left:18px; }}
+  .drivers li {{ margin:5px 0; font-size:15px; }}
+
+  .block {{ margin:40px 0 0; }}
+  .block-head {{ border-bottom:1px solid var(--line); padding-bottom:8px; margin-bottom:6px; }}
+  .eyebrow {{ font-family:'Space Mono',monospace; font-size:12px; letter-spacing:.14em;
+    text-transform:uppercase; color:var(--ghost); }}
+  .eyebrow.hot {{ color:var(--hazard); }}
+  .block-head h2 {{ font-size:clamp(21px,3.4vw,30px); font-weight:800; letter-spacing:-.02em; margin:6px 0 2px; }}
+  .note {{ font-size:14px; color:var(--muted); max-width:62ch; margin:2px 0 0; }}
+  .ghost-block .block-head {{ border-color:var(--ghost); }}
+
+  table.findings {{ width:100%; border-collapse:collapse; margin-top:4px; }}
+  .frow td {{ border-bottom:1px solid var(--line); padding:12px 8px; vertical-align:top; }}
+  .sev {{ width:34px; }}
+  .sev-dot {{ display:inline-grid; place-items:center; width:26px; height:26px; border-radius:50%;
+    font-family:'Space Mono',monospace; font-weight:700; font-size:13px; color:var(--paper); background:var(--muted); }}
+  .sev-dot.s10,.sev-dot.s9 {{ background:var(--hazard); }}
+  .sev-dot.s8,.sev-dot.s7 {{ background:#C4531F; }}
+  .sev-dot.s6,.sev-dot.s5 {{ background:#B8862B; }}
+  .lbl {{ font-weight:600; width:210px; font-size:15px; }}
+  .frow.ghost .lbl {{ color:var(--ghost); }}
+  .val {{ min-width:180px; }}
+  code.redaction {{ background:var(--ink); color:var(--paper); padding:3px 8px; font-size:13px;
+    display:inline-block; letter-spacing:.02em; }}
+  .frow.ghost code.redaction {{ background:var(--ghost); }}
+  .loc {{ font-family:'Space Mono',monospace; font-size:12px; color:var(--muted); }}
+  .commit {{ color:var(--ghost); }}
+  .fixsteps {{ margin:14px 0 0; padding-left:20px; }}
+  .fixsteps li {{ margin:12px 0; font-size:15px; line-height:1.5; max-width:70ch; }}
+  .cmd {{ display:block; margin:8px 0; background:var(--ink); color:var(--paper);
+    font-family:'Space Mono',monospace; font-size:12.5px; padding:8px 12px; overflow-x:auto; }}
+  .repo {{ display:inline-block; background:var(--ink); color:var(--paper);
+    font-family:'Space Mono',monospace; font-size:11px; padding:1px 6px; margin-right:6px; }}
+  .loc a {{ color:var(--ink); text-decoration:underline; text-underline-offset:2px; }}
+  .frow.ghost .loc a {{ color:var(--ghost); }}
+  .rem {{ margin-top:6px; font-family:'Archivo',sans-serif; font-size:13px; color:var(--ink); max-width:52ch; }}
+
+  .meta-grid {{ display:grid; grid-template-columns:repeat(4,1fr); gap:1px; background:var(--line);
+    border:1px solid var(--line); margin-top:12px; }}
+  @media(max-width:640px){{ .meta-grid{{ grid-template-columns:repeat(2,1fr); }} }}
+  .meta-cell {{ background:var(--panel); padding:16px; }}
+  .mk {{ font-family:'Space Mono',monospace; font-size:11px; letter-spacing:.1em; text-transform:uppercase; color:var(--muted); }}
+  .mv {{ font-family:'Space Mono',monospace; font-size:14px; margin-top:6px; word-break:break-word; }}
+
+  .foot {{ margin-top:56px; border-top:2px solid var(--ink); padding-top:16px;
+    font-family:'Space Mono',monospace; font-size:12px; color:var(--muted); line-height:1.6; }}
+  .foot b {{ color:var(--ink); }}
+</style></head>
+<body><div class="sheet">
+
+  <div class="top">
+    <div class="brand">git<b>ghost</b> // exposure dossier</div>
+    <div class="filed">FILED {ts}<br>{repos_scanned} public repo{'s' if repos_scanned!=1 else ''} scanned</div>
+  </div>
+
+  <div class="hero">
+    <div>
+      <div class="target-eyebrow">Subject of report</div>
+      <div class="target">@<span>{_esc(identity)}</span></div>
+      <div class="scope">Public repositories only. Detection-only: no discovered
+      credential was ever tested against its provider.</div>
+    </div>
+    <div class="scorebox">
+      <div class="stamp">{_esc(card.band)}</div>
+      <div class="k">Exposure Score</div>
+      <div class="bignum">{card.score}<small>/100</small></div>
+      <div class="meter"><i></i></div>
+      <div class="grade">Grade <b>{_esc(card.grade)}</b> · higher is worse · worst find: {_esc(card.worst)}</div>
+    </div>
+  </div>
+
+  <div class="drivers">
+    <h3>What's driving this score</h3>
+    <ul>{drivers}</ul>
+  </div>
+
+  {ghost_section}
+  {live_section}
+  {infra_section}
+
+  <section class="block fixguide">
+    <div class="block-head"><span class="eyebrow">How to actually fix these</span>
+      <h2>Rotate first. Deleting the repo doesn't help.</h2></div>
+    <ol class="fixsteps">
+      <li><b>Rotate the credential at the provider.</b> This is the real fix. Anyone
+        who cloned the repo already has the key, so revoking or rotating it is the
+        only thing that truly closes the exposure. Each finding above says where to
+        do this. Do this <i>first</i>.</li>
+      <li><b>Then purge it from history.</b> Deleting the line in a new commit isn't
+        enough — the old commit still holds the secret (that's what the "ghost"
+        findings are). Strip the file from all history and force-push:
+        <code class="cmd">git filter-repo --path PATH/TO/FILE --invert-paths</code>
+        then <code class="cmd">git push --force</code>. (Install <code>git-filter-repo</code>
+        first; it's safer than the old filter-branch.)</li>
+      <li><b>Don't just delete the repo or the commit.</b> That doesn't un-leak
+        anything already public, and it throws away your history for no security
+        benefit. Rotate the key, then do the history surgery.</li>
+    </ol>
+  </section>
+
+  {meta_section}
+
+  <div class="foot">
+    <b>gitghost</b> — an exposure audit built from public data. It surfaces and
+    scores what a GitHub identity already published, including material believed
+    deleted but still recoverable from git history.<br>
+    It is <b>detection-only by design</b>: it reports that a string matches a
+    credential format and stops. It never authenticates with a discovered secret,
+    never touches private repositories, and is meant for auditing your own
+    identity or one you're authorized to assess.<br>
+    Every finding is shown as a non-reversible fingerprint (a safe prefix, a
+    length, and a partial hash) — never recoverable key material — so this report
+    is safe to share. gitghost does not retain the raw secret past the match.
+  </div>
+
+</div></body></html>"""

gitghost/rules.py

@@ -0,0 +1,178 @@
+import hashlib
+import math
+import re
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class Rule:
+    id: str
+    label: str
+    pattern: re.Pattern
+    severity: int
+    kind: str = "secret"
+    remediation: str = ""
+
+
+PROVIDER_RULES: list[Rule] = [
+    Rule("aws-access-key-id", "AWS Access Key ID",
+         re.compile(r"\b(AKIA|ASIA)[0-9A-Z]{16}\b"), 9,
+         remediation="Deactivate the key in IAM immediately, then rotate. Assume it is compromised the moment it touched a public commit."),
+    Rule("aws-secret-key", "AWS Secret Access Key",
+         re.compile(r"(?i)aws.{0,20}?(secret|sk).{0,30}?['\"=:\s]([A-Za-z0-9/+=]{40})\b"), 10,
+         remediation="Rotate the secret key and audit CloudTrail for use since the commit date."),
+    Rule("gcp-service-account", "GCP Service Account Key",
+         re.compile(r"\"type\":\s*\"service_account\""), 9,
+         remediation="Delete and regenerate the service-account key in GCP IAM."),
+    Rule("github-pat", "GitHub Personal Access Token",
+         re.compile(r"\bghp_[A-Za-z0-9]{36}\b"), 8,
+         remediation="Revoke the token under GitHub Settings > Developer settings > Tokens."),
+    Rule("github-oauth", "GitHub OAuth / App Token",
+         re.compile(r"\b(gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b"), 8,
+         remediation="Revoke the token and rotate the associated OAuth app secret."),
+    Rule("stripe-secret", "Stripe Secret Key",
+         re.compile(r"\bsk_live_[A-Za-z0-9]{24,}\b"), 9,
+         remediation="Roll the key in the Stripe dashboard; check for unexpected charges."),
+    Rule("slack-token", "Slack Token",
+         re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b"), 6,
+         remediation="Revoke the token in the Slack admin console."),
+    Rule("slack-webhook", "Slack Incoming Webhook",
+         re.compile(r"https://hooks\.slack\.com/services/T[A-Za-z0-9_/]+"), 4,
+         remediation="Delete the webhook; anyone with the URL can post to the channel."),
+    Rule("google-api-key", "Google API Key",
+         re.compile(r"\bAIza[0-9A-Za-z\-_]{35}\b"), 6,
+         remediation="Restrict or regenerate the key in the Google Cloud console."),
+    Rule("openai-key", "OpenAI API Key",
+         re.compile(r"\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b"), 7,
+         remediation="Revoke the key at platform.openai.com; you are billed for its usage."),
+    Rule("private-key", "Private Key Block",
+         re.compile(r"-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----"), 9,
+         remediation="Treat the key pair as burned. Generate a new pair and rotate every place the public key was trusted."),
+    Rule("jwt", "JSON Web Token",
+         re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"), 5,
+         remediation="If this is a signing secret or long-lived token, rotate it. Decode (don't trust) to confirm scope."),
+    Rule("db-connection", "Database Connection String",
+         re.compile(r"\b(postgres|postgresql|mysql|mongodb(\+srv)?|redis)://[^\s:@/]+:[^\s:@/]+@[^\s/]+"), 8,
+         remediation="Rotate the database password; the credential and host are both exposed."),
+]
+
+
+INFRA_RULES: list[Rule] = [
+    Rule("internal-host", "Internal Hostname", kind="infra", severity=2,
+         pattern=re.compile(r"\b[a-z0-9-]+(\.[a-z0-9-]+)*\.(internal|corp|intranet|lan)\b"),
+         remediation="Scrub internal DNS names from committed config; they reveal network topology."),
+    Rule("private-ip", "Hardcoded Private IP", kind="infra", severity=1,
+         pattern=re.compile(r"\b(10\.\d{1,3}|192\.168|172\.(1[6-9]|2\d|3[01]))\.\d{1,3}\.\d{1,3}\b"),
+         remediation="Move host addresses to environment config rather than source."),
+]
+
+SECRETISH_ASSIGN = re.compile(
+    r"""(?ix)
+    (?P<name>\w*(secret|token|passwd|password|api[_-]?key|apikey|access[_-]?key|private[_-]?key|auth)\w*)
+    \s*[:=]\s*
+    ['"]?(?P<val>[A-Za-z0-9/+_=.\-]{16,})['"]?
+    """
+)
+
+
+def shannon_entropy(s: str) -> float:
+    if not s:
+        return 0.0
+    freq = {c: s.count(c) for c in set(s)}
+    n = len(s)
+    return -sum((c / n) * math.log2(c / n) for c in freq.values())
+
+
+@dataclass
+class Finding:
+    rule_id: str
+    label: str
+    kind: str
+    severity: int
+    line_no: int
+    redacted: str
+    entropy: float = 0.0
+    remediation: str = ""
+
+    repo: str = ""
+    path: str = ""
+    commit: str = ""
+    is_ghost: bool = False
+    repo_url: str = ""
+
+
+_SAFE_PREFIXES = ("AKIA", "ASIA", "ghp_", "gho_", "ghu_", "ghs_", "ghr_",
+                  "sk_live_", "sk-", "AIza", "xoxb-", "xoxp-", "eyJ")
+
+
+def _fingerprint(value: str) -> str:
+    v = value.strip().strip("'\"")
+    if not v:
+        return ""
+    digest = hashlib.sha256(v.encode("utf-8", "ignore")).hexdigest()[:10]
+    prefix = ""
+    for p in _SAFE_PREFIXES:
+        if v.startswith(p):
+            prefix = f"{p}… "
+            break
+    return f"{prefix}{len(v)} chars · fp:{digest}"
+
+
+def scan_text(text: str) -> list[Finding]:
+    findings: list[Finding] = []
+    lines = text.splitlines()
+    for i, line in enumerate(lines, 1):
+        if len(line) > 4000:
+            continue
+        matched_spans: list[tuple[int, int]] = []
+        for rule in (*PROVIDER_RULES, *INFRA_RULES):
+            for m in rule.pattern.finditer(line):
+                raw = m.group(0)
+                matched_spans.append(m.span())
+                findings.append(Finding(
+                    rule_id=rule.id, label=rule.label, kind=rule.kind,
+                    severity=rule.severity, line_no=i, redacted=_fingerprint(raw),
+                    entropy=round(shannon_entropy(raw), 2),
+                    remediation=rule.remediation,
+                ))
+
+
+        for m in SECRETISH_ASSIGN.finditer(line):
+            val = m.group("val")
+            vstart = m.start("val")
+            already = any(s <= vstart < e for s, e in matched_spans)
+            if not already and _looks_like_secret_value(val):
+                findings.append(Finding(
+                    rule_id="generic-high-entropy",
+                    label="High-Entropy Secret (generic)", kind="secret",
+                    severity=5, line_no=i, redacted=_fingerprint(val),
+                    entropy=round(shannon_entropy(val), 2),
+                    remediation="Confirm whether this is a real credential; if so rotate and move it to a secret manager.",
+                ))
+    return findings
+
+
+_PLACEHOLDER = re.compile(r"(?i)(xxx|placeholder|example|changeme|your[_-]?|dummy|sample|<.*>|\.\.\.|test1234|000000|insecure)")
+
+
+def _looks_like_placeholder(v: str) -> bool:
+    return bool(_PLACEHOLDER.search(v)) or len(set(v)) <= 4
+
+
+_CODE_PUNCT = re.compile(r"[\s.()\[\]{}<>/\\:;,]")
+_KEYISH = re.compile(r"^[A-Za-z0-9_\-+=]+$")
+
+
+def _looks_like_secret_value(val: str) -> bool:
+    v = val.strip().strip("'\"")
+    if len(v) < 20 or _looks_like_placeholder(v):
+        return False
+    if _CODE_PUNCT.search(v):
+        return False
+    if not _KEYISH.fullmatch(v):
+        return False
+    has_digit = any(c.isdigit() for c in v)
+    has_alpha = any(c.isalpha() for c in v)
+    if not (has_digit and has_alpha):
+        return False
+    return shannon_entropy(v) >= 3.5

gitghost/scanner.py

@@ -0,0 +1,53 @@
+import os
+from dataclasses import dataclass, field
+
+from .rules import Finding, scan_text
+
+
+SKIP_DIRS = {".git", "node_modules", "vendor", "dist", "build", ".venv",
+             "venv", "__pycache__", ".next", "target", ".gradle"}
+SKIP_EXT = {".png", ".jpg", ".jpeg", ".gif", ".webp", ".ico", ".pdf", ".zip",
+            ".gz", ".tar", ".woff", ".woff2", ".ttf", ".mp4", ".mp3", ".lock",
+            ".min.js", ".map", ".so", ".dll", ".class", ".pyc"}
+MAX_BYTES = 2_000_000
+
+
+@dataclass
+class RepoScan:
+    repo: str
+    findings: list[Finding] = field(default_factory=list)
+    files_scanned: int = 0
+
+
+def _readable(path: str) -> str | None:
+    _, ext = os.path.splitext(path)
+    if ext.lower() in SKIP_EXT:
+        return None
+    try:
+        if os.path.getsize(path) > MAX_BYTES:
+            return None
+        with open(path, "r", encoding="utf-8", errors="ignore") as f:
+            return f.read()
+    except (OSError, ValueError):
+        return None
+
+
+def scan_repo(root: str, repo_name: str) -> RepoScan:
+    result = RepoScan(repo=repo_name)
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for fn in filenames:
+            full = os.path.join(dirpath, fn)
+            text = _readable(full)
+            if text is None:
+                continue
+            result.files_scanned += 1
+            rel = os.path.relpath(full, root)
+            for f in scan_text(text):
+                f.repo = repo_name
+                f.path = rel
+
+                if os.path.basename(rel).startswith(".env") and f.kind == "secret":
+                    f.severity = min(10, f.severity + 1)
+                result.findings.append(f)
+    return result

gitghost/score.py

@@ -0,0 +1,86 @@
+import math
+from dataclasses import dataclass, field
+
+from .metadata import MetadataReport
+from .rules import Finding
+
+BANDS = [
+    (80, "CRITICAL", "F"),
+    (60, "HIGH", "D"),
+    (40, "MODERATE", "C"),
+    (20, "LOW", "B"),
+    (0, "MINIMAL", "A"),
+]
+
+
+@dataclass
+class ScoreCard:
+    score: int
+    band: str
+    grade: str
+    live_secrets: int = 0
+    ghost_secrets: int = 0
+    pii_hits: int = 0
+    infra_hits: int = 0
+    worst: str = ""
+    drivers: list[str] = field(default_factory=list)
+
+
+def _band(score: int) -> tuple[str, str]:
+    for threshold, band, grade in BANDS:
+        if score >= threshold:
+            return band, grade
+    return "MINIMAL", "A"
+
+
+def compute_score(findings: list[Finding], meta: MetadataReport) -> ScoreCard:
+    meta = meta or MetadataReport()
+    secrets = [f for f in findings if f.kind == "secret"]
+    infra = [f for f in findings if f.kind == "infra"]
+    live = [f for f in secrets if not f.is_ghost]
+    ghost = [f for f in secrets if f.is_ghost]
+
+
+    raw = 0.0
+    for f in secrets:
+        raw += f.severity * (0.9 if f.is_ghost else 1.0)
+    for f in infra:
+        raw += f.severity * 0.5
+    pii = 0
+    if meta.emails:
+        raw += 6
+        pii += 1
+    if meta.dominant_utc_offset:
+        raw += 3
+        pii += 1
+    aggregate = 100 * (1 - math.exp(-raw / 26))
+
+
+    floor = 0.0
+    worst_label = "—"
+    if secrets:
+        worst = max(secrets, key=lambda f: f.severity)
+        worst_label = worst.label + (" (ghost)" if worst.is_ghost else " (live)")
+        floor = worst.severity * 8 * (0.9 if worst.is_ghost else 1.0)
+
+    score = int(round(min(100, max(floor, aggregate))))
+    band, grade = _band(score)
+
+    drivers: list[str] = []
+    if live:
+        drivers.append(f"{len(live)} live secret{'s' if len(live) != 1 else ''} in current code")
+    if ghost:
+        drivers.append(f"{len(ghost)} 'deleted' secret{'s' if len(ghost) != 1 else ''} still recoverable from history")
+    if meta.emails:
+        drivers.append(f"real author email exposed ({meta.emails[0]})")
+    if meta.dominant_utc_offset:
+        drivers.append(f"timezone inferable from commit times (UTC{meta.dominant_utc_offset})")
+    if infra:
+        drivers.append(f"{len(infra)} internal infrastructure breadcrumb{'s' if len(infra) != 1 else ''}")
+
+    return ScoreCard(
+        score=score, band=band, grade=grade,
+        live_secrets=len(live), ghost_secrets=len(ghost),
+        pii_hits=pii, infra_hits=len(infra),
+        worst=worst_label, drivers=drivers,
+    )

gitghost_scanner-1.2.0.dist-info/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CyberM
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

gitghost_scanner-1.2.0.dist-info/METADATA

@@ -0,0 +1,99 @@
+Metadata-Version: 2.2
+Name: gitghost-scanner
+Version: 1.2.0
+Summary: Find secrets in a GitHub account's public repos — including the ones still hiding in git history after being 'deleted'.
+Author: cy3erm
+License: MIT
+Project-URL: Homepage, https://github.com/cy3erm/gitghost
+Project-URL: Repository, https://github.com/cy3erm/gitghost
+Project-URL: Issues, https://github.com/cy3erm/gitghost/issues
+Keywords: security,secrets-detection,git,osint,devsecops,bug-bounty
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+
+# gitghost
+![gitghost exposure dossier](preview.png)
+Finds secrets in a GitHub account's public repos — including the ones that got committed, then "deleted," but are still sitting in the git history where anyone can read them.
+
+I built this after noticing how often the real leak isn't in someone's current code — it's in a commit from eight months ago that they thought they'd cleaned up. You paste an API key, catch it, delete the line, and move on. The latest version looks fine. But the old commit still has the key, and `git log` hands it to anyone who clones the repo. Most scanners only look at your current files and miss this entirely. gitghost goes digging through history for exactly those, and then rolls everything up into a single exposure score so you can actually tell how bad things are at a glance.
+
+```
+$ gitghost cy3erm
+
+EXPOSURE SCORE: 96/100  [CRITICAL]  grade F
+  · 7 live secrets in current code
+  · 3 "deleted" secrets still recoverable from history
+  · author email exposed in commit metadata
+  · timezone inferable from commit times (UTC+0530)
+
+dossier written to gitghost-dossier.html
+```
+
+You get an HTML report you can open in a browser, not just a wall of terminal text. Every finding links straight to the spot — the exact file and line for live secrets, or the commit for the ones recovered from history — so you're not hunting for where the key actually is. And the report ends with a short how-to-fix guide, because the instinct when you see a leaked key (delete the file, nuke the repo) doesn't actually fix anything: the key's already been cloned. The real fix is to rotate it, then purge it from history, and the report walks you through both.
+
+## Running it
+
+You'll need Python 3.10+ and git. There are no runtime dependencies — it's all standard library.
+
+Install it as a command:
+
+```bash
+pipx install git+https://github.com/cy3erm/gitghost
+gitghost <username>
+```
+
+Or just clone and run it without installing:
+
+```bash
+git clone https://github.com/cy3erm/gitghost
+cd gitghost
+python3 -m gitghost <username>
+```
+
+If you'd rather not point it at a real person first, there's a demo. It builds a little repo with fake credentials — including one that gets "deleted" a few commits in — so you can watch the history recovery dig it back out:
+
+```bash
+bash demo/make_demo_repo.sh /tmp/demo
+python3 -m gitghost --local /tmp/demo --name demo
+```
+
+A few other flags:
+
+```bash
+python3 -m gitghost <username> --limit 50        # cap how many repos
+python3 -m gitghost <username> --out report.html # where to write the report
+python3 -m gitghost --local ./some-repo          # scan a checkout you have locally
+python3 -m gitghost --repo owner/name            # scan just one repo (URL or owner/name)
+```
+
+Scanning more than a couple of accounts? Set `GITHUB_TOKEN` (any token works, it doesn't need any scopes) so you don't run into GitHub's 60-requests-an-hour limit for anonymous calls.
+
+## What it looks for
+
+- Cloud and service keys — AWS, GCP, Stripe, GitHub, OpenAI, Slack, private keys, database URLs
+- The same keys pulled back out of history after they were removed from the current code
+- Metadata you might not realize you're sharing — the email in your commits, and a rough guess at your timezone and working hours from commit timestamps
+- Committed `.env` files, internal hostnames, hardcoded private IPs
+
+The score is deliberately one number so you can watch it move — run it, clean things up, run it again. A single live cloud key is enough to put an account in the red by itself; a pile of smaller stuff pushes it up from there.
+
+## Where it draws the line
+
+It only ever reads public repositories — things the account already chose to publish — and it's detection-only. It'll tell you a string *looks like* a credential and leave it at that. It won't try the key against the actual service to see if it still works, because quietly logging into someone else's account isn't the tool's job, and honestly it's not yours either. Findings in the report are shown as fingerprints, not the raw values, so you can share a report without leaking anything.
+
+Point it at yourself first. Most people turn up at least one thing they'd completely forgotten about — I did. (The first time I pushed this repo, GitHub's own secret scanner blocked me because the demo's fake keys looked real enough to trip it. Which is about the best proof of the premise I could ask for.)
+
+## Adding your own detections
+
+The patterns live in `gitghost/rules.py`. Each one is just a name, a regex, a severity, and a line of advice for fixing it — easy to add. If you write a good one, send a PR.
+
+## License
+
+MIT

gitghost_scanner-1.2.0.dist-info/RECORD

@@ -0,0 +1,17 @@
+gitghost/__init__.py,sha256=MpAT5hgNoHnTtG1XRD_GV_A7QrHVU6vJjGSw_8qMGA4,22
+gitghost/__main__.py,sha256=z3OQolCKD8rUd3pKYp_FISq2VctFhFl1mV-DVnaoNOM,29
+gitghost/banner.py,sha256=n-q2IKMqnyBPZiDzgU_60vNn0Nnt7YPHMmKSpSIt2H8,976
+gitghost/cli.py,sha256=zsSA7SYmVHSFGa3uPwTMNQ2OUOnyEtuKUH7mZBJhGq4,4552
+gitghost/ghost.py,sha256=YOCQKon_vxKDZUAn34w8zYaVIkSzWdXD69W4g9q-6Iw,2615
+gitghost/github.py,sha256=iw4lZCwg5qDgor6pLt0v9-JipgqtWwzH6O9xcTD73cQ,2310
+gitghost/metadata.py,sha256=EtAIXsHBhCfX569VnATfzWeuL3t37-gAA-ZzpVDyeGM,1560
+gitghost/report.py,sha256=S5maXwP8hfHrfPksATfPj2On0_IyNC4WFr0enOvDHjM,14038
+gitghost/rules.py,sha256=VLQZYe_nx7aLDAH3BkEDkKO3bGPh4--0lzY0_HVleug,7142
+gitghost/scanner.py,sha256=FWVBhI3UplRI7UpQgl4xM3yz-N5AiFjhdaItZK9vnTY,1729
+gitghost/score.py,sha256=nHsntzReBb15Q8XyQwbtVfZ2HIvnqh2DUP2aZNSaB6s,2519
+gitghost_scanner-1.2.0.dist-info/LICENSE,sha256=tjrNXBeGFejjQVj8bxB-d8pegRqxpAV_dsJIN1hqIiQ,1063
+gitghost_scanner-1.2.0.dist-info/METADATA,sha256=b_NUeXJBoYQDhgK_Rl_PrFNRf9YRluNsyM_buW3Ryfk,5473
+gitghost_scanner-1.2.0.dist-info/WHEEL,sha256=beeZ86-EfXScwlR_HKu4SllMC9wUEj_8Z_4FJ3egI2w,91
+gitghost_scanner-1.2.0.dist-info/entry_points.txt,sha256=RqWCch6nQ7UQ-PNhlXoeM1ioE7iZdRHG6MUloz1ibcc,47
+gitghost_scanner-1.2.0.dist-info/top_level.txt,sha256=mojEQo6pt-3lkeJxbiwqWxsm0Z7PMngvymEH863d73g,9
+gitghost_scanner-1.2.0.dist-info/RECORD,,

gitghost_scanner-1.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (76.1.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

gitghost_scanner-1.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+gitghost = gitghost.cli:main

gitghost_scanner-1.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+gitghost