gitghost-scanner 1.4.0__tar.gz → 1.4.1__tar.gz

{gitghost_scanner-1.4.0/gitghost_scanner.egg-info → gitghost_scanner-1.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: gitghost-scanner
-Version: 1.4.0
+Version: 1.4.1
 Summary: Find secrets in a GitHub account's public repos — including the ones still hiding in git history after being 'deleted'.
 Author: cy3erm
 License: MIT
@@ -29,22 +29,22 @@ License-File: LICENSE
 
 **The secrets you deleted are still in git history.** gitghost finds them.
 
-Finds live credentials in a GitHub account's public repos — *and* the ones that were committed, "deleted," and are still sitting one `git log` away for anyone who clones.
+Finds live credentials in a GitHub account's public repos, *and* the ones that were committed, "deleted," and are still sitting one `git log` away for anyone who clones.
 
-I built this after noticing how often the real leak isn't in someone's current code — it's in a commit from eight months ago that they thought they'd cleaned up. You paste an API key, catch it, delete the line, and move on. The latest version looks fine. But the old commit still has the key, and anyone who clones the repo gets it. Most scanners only look at your current files and miss this entirely. gitghost digs through history for exactly those, then rolls everything into a single **exposure score** so you can tell how bad things are at a glance.
+I built this after noticing how often the real leak isn't in someone's current code. It's in a commit from eight months ago that they thought they'd cleaned up. You paste an API key, catch it, delete the line, and move on. The latest version looks fine. But the old commit still has the key, and anyone who clones the repo gets it. Most scanners only look at your current files and miss this entirely. gitghost digs through history for exactly those, then rolls everything into a single **exposure score** so you can tell how bad things are at a glance.
 
 ## Highlights
 
-- **Ghost recovery** — walks the full git history of every repo (including unreachable objects) to recover secrets that were removed from HEAD but never purged
-- **Force-push recovery** — even if you rewrote history, your recent push events still list the orphaned commit SHAs; gitghost fetches those commits by SHA and scans what the force-push tried to bury
-- **Gist revision history** — secrets you edited out of a gist stay readable at old revision URLs; gitghost scans every revision and flags the ones that were "deleted"
-- **40+ credential formats** — AWS, GCP, GitHub, OpenAI, Anthropic, Stripe, Slack, Google, Azure, Telegram, Discord, Notion, Shopify, Vault, Postman, Square, and many more (full list below)
-- **Generic high-entropy detection** — catches secrets that don't match any known format, with false-positive filtering tuned against real codebases
-- **Exposure score (0–100)** — one number that weights severity, age of the leak, cross-repo reuse, and whether a "deleted" secret is *still in use* somewhere
-- **Metadata leaks** — the author email in your commits, plus inferred timezone and working hours; profile enrichment pulls public name, company, location, blog, and account age
-- **HTML dossier output** — every finding links to the exact file+line or commit; findings are shown as irreversible fingerprints so reports are safe to share
-- **Interactive console** or one-shot CLI — your choice
-- **Zero dependencies** — pure Python 3.10+ standard library
+- **Ghost recovery:** walks the full git history of every repo (including unreachable objects) to recover secrets that were removed from HEAD but never purged
+- **Force-push recovery:** even if you rewrote history, your recent push events still list the orphaned commit SHAs; gitghost fetches those commits by SHA and scans what the force-push tried to bury
+- **Gist revision history:** secrets you edited out of a gist stay readable at old revision URLs; gitghost scans every revision and flags the ones that were "deleted"
+- **40+ credential formats:** AWS, GCP, GitHub, OpenAI, Anthropic, Stripe, Slack, Google, Azure, Telegram, Discord, Notion, Shopify, Vault, Postman, Square, and many more (full list below)
+- **Generic high-entropy detection:** catches secrets that don't match any known format, with false-positive filtering tuned against real codebases
+- **Exposure score (0–100):** one number that weights severity, age of the leak, cross-repo reuse, and whether a "deleted" secret is *still in use* somewhere
+- **Metadata leaks:** the author email in your commits, plus inferred timezone and working hours; profile enrichment pulls public name, company, location, blog, and account age
+- **HTML dossier output:** every finding links to the exact file+line or commit; findings are shown as irreversible fingerprints so reports are safe to share
+- **Interactive console** or one-shot CLI, your choice
+- **Zero dependencies:** pure Python 3.10+ standard library
 
 ## Install
 
@@ -63,7 +63,7 @@ cd gitghost
 python3 -m gitghost
 ```
 
-> Set `GITHUB_TOKEN` (any token works — it doesn't need scopes) to raise GitHub's 60-requests/hour anonymous limit before scanning more than an account or two.
+> Set `GITHUB_TOKEN` (any token works, it doesn't need scopes) to raise GitHub's 60-requests/hour anonymous limit before scanning more than an account or two.
 
 ## Usage
 
@@ -78,7 +78,7 @@ $ gitghost
  / /_/ / / /_/ /_/ / / / /_/ (__  ) /_
  \__, /_/\__/\__, /_/ /_/\____/____/\__/
 /____/      /____/
-the secrets you deleted are still in git history v1.3.0
+the secrets you deleted are still in git history v1.4.1
 by cy3erm · github.com/cy3erm/gitghost
 
   1) Scan a GitHub user          public repos + gists
@@ -117,7 +117,7 @@ gitghost --jobs 8                   # parallel clones/scans (default 4)
 gitghost --debug                    # full traceback if something breaks
 ```
 
-Try the demo first if you'd rather not point this at a real person — it builds a tiny repo with fake credentials, including one that gets "deleted" a few commits in:
+Try the demo first if you'd rather not point this at a real person. It builds a tiny repo with fake credentials, including one that gets "deleted" a few commits in:
 
 ```bash
 bash demo/make_demo_repo.sh /tmp/demo
@@ -140,32 +140,32 @@ OpenAI (classic + project keys) · Anthropic · Groq · Perplexity · xAI · Hug
 **Communication & SaaS**
 Slack (tokens, webhooks, app tokens) · Discord (webhooks, bot tokens) · Telegram bot tokens · Twilio · SendGrid · Mailgun · Notion integration secrets · Shopify · Square · Razorpay · DigitalOcean · Doppler · Firebase Cloud Messaging server keys · Google API keys and OAuth refresh tokens
 
-**Everything else** — a generic high-entropy scanner looks for values assigned to suspiciously-named variables (`api_key = "..."`) even when no provider pattern matches, filtered through placeholder/entropy checks to keep false positives near zero.
+**Everything else**: a generic high-entropy scanner looks for values assigned to suspiciously-named variables (`api_key = "..."`) even when no provider pattern matches, filtered through placeholder/entropy checks to keep false positives near zero.
 
-Missing a provider you care about? Rules are four lines each in [`gitghost/rules.py`](gitghost/rules.py) — name, regex, severity, remediation advice. PRs welcome.
+Missing a provider you care about? Rules are four lines each in [`gitghost/rules.py`](gitghost/rules.py): name, regex, severity, remediation advice. PRs welcome.
 
 ## The score
 
 One number, 0–100, higher is worse:
 
-- **Severity-weighted findings** — a live AWS secret key counts far more than a webhook URL
-- **Ghost weighting** — recovered-from-history secrets scale with age: something exposed for 2 years hurts more than something from last week
-- **Reuse correlation** — the same secret across multiple repos, and the nastiest case: a "deleted" secret whose fingerprint still matches something *live*
-- **Metadata exposure** — real email in commits, inferable timezone
+- **Severity-weighted findings:** a live AWS secret key counts far more than a webhook URL
+- **Ghost weighting:** recovered-from-history secrets scale with age: something exposed for 2 years hurts more than something from last week
+- **Reuse correlation:** the same secret across multiple repos, and the nastiest case: a "deleted" secret whose fingerprint still matches something *live*
+- **Metadata exposure:** real email in commits, inferable timezone
 
-A single live cloud key is enough to put an account in the red by itself. Run it, clean up, run again — the number tells you if it worked.
+A single live cloud key is enough to put an account in the red by itself. Run it, clean up, run again, and the number tells you if it worked.
 
 ## Where it draws the line (legal & ethics)
 
-It only ever reads public repositories — things the account already chose to publish — and it's detection-only. It'll tell you a string *looks like* a credential and leave it at that. It won't try the key against the actual service to see if it still works, because quietly logging into someone else's account isn't the tool's job, and honestly it's not yours either. Use it on your own identity, or one you're authorized to assess.
+It only ever reads public repositories (things the account already chose to publish), and it's detection-only. It'll tell you a string *looks like* a credential and leave it at that. It won't try the key against the actual service to see if it still works, because quietly logging into someone else's account isn't the tool's job, and honestly it's not yours either. Use it on your own identity, or one you're authorized to assess.
 
-Findings are shown as non-reversible fingerprints (a safe prefix, a length, a partial hash) — never recoverable key material — so reports are safe to share. gitghost does not retain raw secrets past the match.
+Findings are shown as non-reversible fingerprints (a safe prefix, a length, a partial hash), never recoverable key material, so reports are safe to share. gitghost does not retain raw secrets past the match.
 
-Point it at yourself first. Most people turn up at least one thing they'd completely forgotten about — I did.
+Point it at yourself first. Most people turn up at least one thing they'd completely forgotten about. I did.
 
 ## Leaked something? The fix is rotate, not delete.
 
-Deleting the file or the repo doesn't un-leak anything — anyone who cloned already has the key. Rotate the credential first, then purge history with `git filter-repo`. The end of every dossier walks through both steps.
+Deleting the file or the repo doesn't un-leak anything: anyone who cloned already has the key. Rotate the credential first, then purge history with `git filter-repo`. The end of every dossier walks through both steps.
 
 ## Development
 

{gitghost_scanner-1.4.0 → gitghost_scanner-1.4.1}/README.md

@@ -9,22 +9,22 @@
 
 **The secrets you deleted are still in git history.** gitghost finds them.
 
-Finds live credentials in a GitHub account's public repos — *and* the ones that were committed, "deleted," and are still sitting one `git log` away for anyone who clones.
+Finds live credentials in a GitHub account's public repos, *and* the ones that were committed, "deleted," and are still sitting one `git log` away for anyone who clones.
 
-I built this after noticing how often the real leak isn't in someone's current code — it's in a commit from eight months ago that they thought they'd cleaned up. You paste an API key, catch it, delete the line, and move on. The latest version looks fine. But the old commit still has the key, and anyone who clones the repo gets it. Most scanners only look at your current files and miss this entirely. gitghost digs through history for exactly those, then rolls everything into a single **exposure score** so you can tell how bad things are at a glance.
+I built this after noticing how often the real leak isn't in someone's current code. It's in a commit from eight months ago that they thought they'd cleaned up. You paste an API key, catch it, delete the line, and move on. The latest version looks fine. But the old commit still has the key, and anyone who clones the repo gets it. Most scanners only look at your current files and miss this entirely. gitghost digs through history for exactly those, then rolls everything into a single **exposure score** so you can tell how bad things are at a glance.
 
 ## Highlights
 
-- **Ghost recovery** — walks the full git history of every repo (including unreachable objects) to recover secrets that were removed from HEAD but never purged
-- **Force-push recovery** — even if you rewrote history, your recent push events still list the orphaned commit SHAs; gitghost fetches those commits by SHA and scans what the force-push tried to bury
-- **Gist revision history** — secrets you edited out of a gist stay readable at old revision URLs; gitghost scans every revision and flags the ones that were "deleted"
-- **40+ credential formats** — AWS, GCP, GitHub, OpenAI, Anthropic, Stripe, Slack, Google, Azure, Telegram, Discord, Notion, Shopify, Vault, Postman, Square, and many more (full list below)
-- **Generic high-entropy detection** — catches secrets that don't match any known format, with false-positive filtering tuned against real codebases
-- **Exposure score (0–100)** — one number that weights severity, age of the leak, cross-repo reuse, and whether a "deleted" secret is *still in use* somewhere
-- **Metadata leaks** — the author email in your commits, plus inferred timezone and working hours; profile enrichment pulls public name, company, location, blog, and account age
-- **HTML dossier output** — every finding links to the exact file+line or commit; findings are shown as irreversible fingerprints so reports are safe to share
-- **Interactive console** or one-shot CLI — your choice
-- **Zero dependencies** — pure Python 3.10+ standard library
+- **Ghost recovery:** walks the full git history of every repo (including unreachable objects) to recover secrets that were removed from HEAD but never purged
+- **Force-push recovery:** even if you rewrote history, your recent push events still list the orphaned commit SHAs; gitghost fetches those commits by SHA and scans what the force-push tried to bury
+- **Gist revision history:** secrets you edited out of a gist stay readable at old revision URLs; gitghost scans every revision and flags the ones that were "deleted"
+- **40+ credential formats:** AWS, GCP, GitHub, OpenAI, Anthropic, Stripe, Slack, Google, Azure, Telegram, Discord, Notion, Shopify, Vault, Postman, Square, and many more (full list below)
+- **Generic high-entropy detection:** catches secrets that don't match any known format, with false-positive filtering tuned against real codebases
+- **Exposure score (0–100):** one number that weights severity, age of the leak, cross-repo reuse, and whether a "deleted" secret is *still in use* somewhere
+- **Metadata leaks:** the author email in your commits, plus inferred timezone and working hours; profile enrichment pulls public name, company, location, blog, and account age
+- **HTML dossier output:** every finding links to the exact file+line or commit; findings are shown as irreversible fingerprints so reports are safe to share
+- **Interactive console** or one-shot CLI, your choice
+- **Zero dependencies:** pure Python 3.10+ standard library
 
 ## Install
 
@@ -43,7 +43,7 @@ cd gitghost
 python3 -m gitghost
 ```
 
-> Set `GITHUB_TOKEN` (any token works — it doesn't need scopes) to raise GitHub's 60-requests/hour anonymous limit before scanning more than an account or two.
+> Set `GITHUB_TOKEN` (any token works, it doesn't need scopes) to raise GitHub's 60-requests/hour anonymous limit before scanning more than an account or two.
 
 ## Usage
 
@@ -58,7 +58,7 @@ $ gitghost
  / /_/ / / /_/ /_/ / / / /_/ (__  ) /_
  \__, /_/\__/\__, /_/ /_/\____/____/\__/
 /____/      /____/
-the secrets you deleted are still in git history v1.3.0
+the secrets you deleted are still in git history v1.4.1
 by cy3erm · github.com/cy3erm/gitghost
 
   1) Scan a GitHub user          public repos + gists
@@ -97,7 +97,7 @@ gitghost --jobs 8                   # parallel clones/scans (default 4)
 gitghost --debug                    # full traceback if something breaks
 ```
 
-Try the demo first if you'd rather not point this at a real person — it builds a tiny repo with fake credentials, including one that gets "deleted" a few commits in:
+Try the demo first if you'd rather not point this at a real person. It builds a tiny repo with fake credentials, including one that gets "deleted" a few commits in:
 
 ```bash
 bash demo/make_demo_repo.sh /tmp/demo
@@ -120,32 +120,32 @@ OpenAI (classic + project keys) · Anthropic · Groq · Perplexity · xAI · Hug
 **Communication & SaaS**
 Slack (tokens, webhooks, app tokens) · Discord (webhooks, bot tokens) · Telegram bot tokens · Twilio · SendGrid · Mailgun · Notion integration secrets · Shopify · Square · Razorpay · DigitalOcean · Doppler · Firebase Cloud Messaging server keys · Google API keys and OAuth refresh tokens
 
-**Everything else** — a generic high-entropy scanner looks for values assigned to suspiciously-named variables (`api_key = "..."`) even when no provider pattern matches, filtered through placeholder/entropy checks to keep false positives near zero.
+**Everything else**: a generic high-entropy scanner looks for values assigned to suspiciously-named variables (`api_key = "..."`) even when no provider pattern matches, filtered through placeholder/entropy checks to keep false positives near zero.
 
-Missing a provider you care about? Rules are four lines each in [`gitghost/rules.py`](gitghost/rules.py) — name, regex, severity, remediation advice. PRs welcome.
+Missing a provider you care about? Rules are four lines each in [`gitghost/rules.py`](gitghost/rules.py): name, regex, severity, remediation advice. PRs welcome.
 
 ## The score
 
 One number, 0–100, higher is worse:
 
-- **Severity-weighted findings** — a live AWS secret key counts far more than a webhook URL
-- **Ghost weighting** — recovered-from-history secrets scale with age: something exposed for 2 years hurts more than something from last week
-- **Reuse correlation** — the same secret across multiple repos, and the nastiest case: a "deleted" secret whose fingerprint still matches something *live*
-- **Metadata exposure** — real email in commits, inferable timezone
+- **Severity-weighted findings:** a live AWS secret key counts far more than a webhook URL
+- **Ghost weighting:** recovered-from-history secrets scale with age: something exposed for 2 years hurts more than something from last week
+- **Reuse correlation:** the same secret across multiple repos, and the nastiest case: a "deleted" secret whose fingerprint still matches something *live*
+- **Metadata exposure:** real email in commits, inferable timezone
 
-A single live cloud key is enough to put an account in the red by itself. Run it, clean up, run again — the number tells you if it worked.
+A single live cloud key is enough to put an account in the red by itself. Run it, clean up, run again, and the number tells you if it worked.
 
 ## Where it draws the line (legal & ethics)
 
-It only ever reads public repositories — things the account already chose to publish — and it's detection-only. It'll tell you a string *looks like* a credential and leave it at that. It won't try the key against the actual service to see if it still works, because quietly logging into someone else's account isn't the tool's job, and honestly it's not yours either. Use it on your own identity, or one you're authorized to assess.
+It only ever reads public repositories (things the account already chose to publish), and it's detection-only. It'll tell you a string *looks like* a credential and leave it at that. It won't try the key against the actual service to see if it still works, because quietly logging into someone else's account isn't the tool's job, and honestly it's not yours either. Use it on your own identity, or one you're authorized to assess.
 
-Findings are shown as non-reversible fingerprints (a safe prefix, a length, a partial hash) — never recoverable key material — so reports are safe to share. gitghost does not retain raw secrets past the match.
+Findings are shown as non-reversible fingerprints (a safe prefix, a length, a partial hash), never recoverable key material, so reports are safe to share. gitghost does not retain raw secrets past the match.
 
-Point it at yourself first. Most people turn up at least one thing they'd completely forgotten about — I did.
+Point it at yourself first. Most people turn up at least one thing they'd completely forgotten about. I did.
 
 ## Leaked something? The fix is rotate, not delete.
 
-Deleting the file or the repo doesn't un-leak anything — anyone who cloned already has the key. Rotate the credential first, then purge history with `git filter-repo`. The end of every dossier walks through both steps.
+Deleting the file or the repo doesn't un-leak anything: anyone who cloned already has the key. Rotate the credential first, then purge history with `git filter-repo`. The end of every dossier walks through both steps.
 
 ## Development
 

gitghost_scanner-1.4.1/gitghost/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.4.1"

{gitghost_scanner-1.4.0 → gitghost_scanner-1.4.1}/gitghost/cli.py

@@ -1,5 +1,6 @@
 import argparse
 import os
+import subprocess
 import sys
 import tempfile
 from concurrent.futures import ThreadPoolExecutor
@@ -7,7 +8,7 @@ from concurrent.futures import ThreadPoolExecutor
 from . import __version__, github
 from .banner import print_banner
 from .ghost import recover_force_pushed, recover_ghosts
-from .metadata import MetadataReport, analyze_metadata
+from .metadata import MetadataReport, _NOREPLY, analyze_metadata, attribute_emails
 from .report import render_report
 from .rules import Finding, scan_text
 from .scanner import HOT_FILES, scan_repo
@@ -48,8 +49,19 @@ def run_local(path: str, name: str, out: str) -> None:
     if not os.path.isdir(path):
         die(f"no such directory: {path!r}",
             "pass the path to a checkout on disk (or use --repo/--org for GitHub repos)")
+    real = os.path.realpath(path)
+    top = subprocess.run(["git", "-C", path, "rev-parse", "--show-toplevel"],
+                         capture_output=True, text=True).stdout.strip()
+    if not top:
+        die(f"{path!r} is not a git repository",
+            "pass the root of a checkout (it must contain a .git), "
+            "or use --repo/--org for GitHub repos")
+    if os.path.realpath(top) != real:
+        die(f"{path!r} is inside a bigger repo rooted at {top!r}",
+            "git commands would silently scan the parent repo — pass the repo root itself")
     info(f"scanning local repo: {name}")
     findings, meta = _scan_one(path, name)
+    attribute_emails(meta)
     card = compute_score(findings, meta)
     _finish(name, card, findings, meta, 1, out)
 
@@ -68,6 +80,7 @@ def run_repo(url: str, out: str) -> None:
         findings, meta = _scan_one(dest, repo.name)
         for finding in findings:
             finding.repo_url = repo.html_url
+        attribute_emails(meta, login=repo.full_name.split("/", 1)[0])
         card = compute_score(findings, meta)
         _finish(repo.full_name, card, findings, meta, 1, out)
 
@@ -234,8 +247,7 @@ def run_identity(identity: str, limit: int, out: str, jobs: int = 4,
         all_findings += gist_findings
 
     merged = merge_metas(metas)
-    card = compute_score(all_findings, merged)
-    merged = merge_metas(metas)
+    attribute_emails(merged, profile, login=identity)
     card = compute_score(all_findings, merged)
     _finish(identity, card, all_findings, merged, repos_scanned, out,
             profile=profile)
@@ -300,6 +312,7 @@ def run_org(org: str, limit: int, out: str, jobs: int = 4,
         metas += mm
 
     merged = merge_metas(metas)
+    attribute_emails(merged)
     card = compute_score(all_findings, merged)
     _finish(f"org:{org}", card, all_findings, merged, len(repos), out)
 
@@ -308,8 +321,16 @@ def merge_metas(metas: list[MetadataReport]) -> MetadataReport:
     """Fold per-repo metadata reports into one."""
     merged = MetadataReport()
     for m in metas:
-        merged.emails += [e for e in m.emails if e not in merged.emails]
-        merged.noreply_emails += [e for e in m.noreply_emails if e not in merged.noreply_emails]
+        for e in m.emails + m.noreply_emails:
+            known = merged.emails + merged.noreply_emails
+            if e not in known:
+                (merged.noreply_emails if _NOREPLY.search(e) else merged.emails).append(e)
+            authors = m.email_authors.get(e)
+            if authors:
+                merged.email_authors.setdefault(e, set()).update(authors)
+            merged.email_repos[e] = max(merged.email_repos.get(e, 0),
+                                        m.email_repos.get(e, 0))
+        merged.other_emails += [e for e in m.other_emails if e not in merged.other_emails]
         merged.commit_count += m.commit_count
         merged.dominant_utc_offset = merged.dominant_utc_offset or m.dominant_utc_offset
         merged.likely_active_hours = merged.likely_active_hours or m.likely_active_hours

gitghost_scanner-1.4.1/gitghost/metadata.py

@@ -0,0 +1,108 @@
+import re
+import subprocess
+from collections import Counter
+from dataclasses import dataclass, field
+
+
+@dataclass
+class MetadataReport:
+    emails: list[str] = field(default_factory=list)
+    noreply_emails: list[str] = field(default_factory=list)
+    other_emails: list[str] = field(default_factory=list)  # co-authors', not the subject's
+    email_authors: dict[str, set[str]] = field(default_factory=dict)
+    email_repos: dict[str, int] = field(default_factory=dict)
+    dominant_utc_offset: str | None = None
+    likely_active_hours: str | None = None
+    commit_count: int = 0
+
+
+_NOREPLY = re.compile(r"noreply|users\.noreply\.github\.com", re.I)
+# GitHub privacy email embeds the login: "123456+octocat@users.noreply.github.com"
+_NOREPLY_LOGIN = re.compile(r"^(?:\d+\+)?([^@]+)@users\.noreply\.github\.com$", re.I)
+
+
+def analyze_metadata(root: str) -> MetadataReport:
+    out = subprocess.run(
+        ["git", "-C", root, "log", "--all", "--format=%an|%ae|%ai"],
+        capture_output=True, text=True, errors="ignore",
+    ).stdout
+
+    emails: Counter[str] = Counter()
+    offsets: Counter[str] = Counter()
+    hours: Counter[int] = Counter()
+    authors: dict[str, set[str]] = {}
+    count = 0
+
+    for line in out.splitlines():
+        if line.count("|") < 2:
+            continue
+        name, email, ts = line.split("|", 2)
+        count += 1
+        email = email.strip()
+        emails[email] += 1
+        authors.setdefault(email, set()).add(name.strip())
+
+        m = re.search(r"(\d{2}):\d{2}:\d{2}\s([+-]\d{4})", ts)
+        if m:
+            hours[int(m.group(1))] += 1
+            offsets[m.group(2)] += 1
+
+    report = MetadataReport(commit_count=count, email_authors=authors,
+                            email_repos={e: 1 for e in emails})
+    for email, _ in emails.most_common():
+        (report.noreply_emails if _NOREPLY.search(email) else report.emails).append(email)
+
+    if offsets:
+        report.dominant_utc_offset = offsets.most_common(1)[0][0]
+    if hours:
+        top = [h for h, _ in hours.most_common(6)]
+        lo, hi = min(top), max(top)
+        report.likely_active_hours = f"{lo:02d}:00–{hi:02d}:00 (local)"
+    return report
+
+
+def _looks_mine(email: str, meta: MetadataReport,
+                profile=None, login: str = "") -> bool:
+    """Does this commit email actually belong to the scanned identity?
+
+    A repo owner's commits are not the only commits in their repos —
+    contributors push with their own identities. Flagging every author
+    address as the subject's email produced false attributions.
+    """
+    e = email.casefold()
+    if profile and profile.email and e == profile.email.casefold():
+        return True
+    m = _NOREPLY_LOGIN.match(email)
+    if m and login and m.group(1).casefold() == login.casefold():
+        return True  # github's privacy email literally contains the login
+    names = {n.casefold() for n in meta.email_authors.get(email, ())}
+    targets = set()
+    if profile:
+        targets |= {profile.name.casefold(), profile.login.casefold()}
+    if login:
+        targets.add(login.casefold())
+    if names & targets:
+        return True
+    # strong signal without any name match: the same address spans several
+    # of the subject's repos — one-off contributors rarely do that
+    return meta.email_repos.get(email, 0) >= 2
+
+
+def attribute_emails(meta: MetadataReport,
+                     profile=None, login: str = "") -> None:
+    """Re-sort meta.emails into the subject's vs co-authors', in place.
+
+    With no identity signals (no profile, no login — e.g. --local) there is
+    nothing to attribute against, so everything stays as before.
+    """
+    if not profile and not login:
+        return
+    mine: list[str] = []
+    others: list[str] = []
+    for email in meta.emails:
+        if _looks_mine(email, meta, profile, login):
+            mine.append(email)
+        else:
+            others.append(email)
+    meta.emails = mine
+    meta.other_emails = others

{gitghost_scanner-1.4.0 → gitghost_scanner-1.4.1}/gitghost/report.py

@@ -114,6 +114,11 @@ def render_report(identity: str, card: ScoreCard, findings: list[Finding],
         </section>"""
 
     emails = ", ".join(_esc(e) for e in meta.emails[:3]) or "none exposed"
+    if getattr(meta, "other_emails", None):
+        others = ", ".join(_esc(e) for e in meta.other_emails[:3])
+        more = f" (+{len(meta.other_emails) - 3} more)" if len(meta.other_emails) > 3 else ""
+    else:
+        others, more = "", ""
     if profile is not None:
         who = " · ".join(x for x in (profile.name, profile.company, profile.location) if x) or "—"
         contact = " · ".join(x for x in (profile.email, profile.blog, profile.twitter) if x) or "—"
@@ -130,6 +135,7 @@ def render_report(identity: str, card: ScoreCard, findings: list[Finding],
       <div class="block-head"><span class="eyebrow">What your commits reveal about you</span></div>
       <div class="meta-grid">{profile_cells}
         <div class="meta-cell"><div class="mk">Author email</div><div class="mv">{emails}</div></div>
+        {'<div class="meta-cell"><div class="mk">Co-author emails (not the subject)</div><div class="mv">' + others + more + '</div></div>' if others else ''}
         <div class="meta-cell"><div class="mk">Timezone (inferred)</div><div class="mv">{_esc(meta.dominant_utc_offset or '—')}</div></div>
         <div class="meta-cell"><div class="mk">Active hours (inferred)</div><div class="mv">{_esc(meta.likely_active_hours or '—')}</div></div>
         <div class="meta-cell"><div class="mk">Commits analyzed</div><div class="mv">{meta.commit_count:,}</div></div>

{gitghost_scanner-1.4.0 → gitghost_scanner-1.4.1/gitghost_scanner.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: gitghost-scanner
-Version: 1.4.0
+Version: 1.4.1
 Summary: Find secrets in a GitHub account's public repos — including the ones still hiding in git history after being 'deleted'.
 Author: cy3erm
 License: MIT
@@ -29,22 +29,22 @@ License-File: LICENSE
 
 **The secrets you deleted are still in git history.** gitghost finds them.
 
-Finds live credentials in a GitHub account's public repos — *and* the ones that were committed, "deleted," and are still sitting one `git log` away for anyone who clones.
+Finds live credentials in a GitHub account's public repos, *and* the ones that were committed, "deleted," and are still sitting one `git log` away for anyone who clones.
 
-I built this after noticing how often the real leak isn't in someone's current code — it's in a commit from eight months ago that they thought they'd cleaned up. You paste an API key, catch it, delete the line, and move on. The latest version looks fine. But the old commit still has the key, and anyone who clones the repo gets it. Most scanners only look at your current files and miss this entirely. gitghost digs through history for exactly those, then rolls everything into a single **exposure score** so you can tell how bad things are at a glance.
+I built this after noticing how often the real leak isn't in someone's current code. It's in a commit from eight months ago that they thought they'd cleaned up. You paste an API key, catch it, delete the line, and move on. The latest version looks fine. But the old commit still has the key, and anyone who clones the repo gets it. Most scanners only look at your current files and miss this entirely. gitghost digs through history for exactly those, then rolls everything into a single **exposure score** so you can tell how bad things are at a glance.
 
 ## Highlights
 
-- **Ghost recovery** — walks the full git history of every repo (including unreachable objects) to recover secrets that were removed from HEAD but never purged
-- **Force-push recovery** — even if you rewrote history, your recent push events still list the orphaned commit SHAs; gitghost fetches those commits by SHA and scans what the force-push tried to bury
-- **Gist revision history** — secrets you edited out of a gist stay readable at old revision URLs; gitghost scans every revision and flags the ones that were "deleted"
-- **40+ credential formats** — AWS, GCP, GitHub, OpenAI, Anthropic, Stripe, Slack, Google, Azure, Telegram, Discord, Notion, Shopify, Vault, Postman, Square, and many more (full list below)
-- **Generic high-entropy detection** — catches secrets that don't match any known format, with false-positive filtering tuned against real codebases
-- **Exposure score (0–100)** — one number that weights severity, age of the leak, cross-repo reuse, and whether a "deleted" secret is *still in use* somewhere
-- **Metadata leaks** — the author email in your commits, plus inferred timezone and working hours; profile enrichment pulls public name, company, location, blog, and account age
-- **HTML dossier output** — every finding links to the exact file+line or commit; findings are shown as irreversible fingerprints so reports are safe to share
-- **Interactive console** or one-shot CLI — your choice
-- **Zero dependencies** — pure Python 3.10+ standard library
+- **Ghost recovery:** walks the full git history of every repo (including unreachable objects) to recover secrets that were removed from HEAD but never purged
+- **Force-push recovery:** even if you rewrote history, your recent push events still list the orphaned commit SHAs; gitghost fetches those commits by SHA and scans what the force-push tried to bury
+- **Gist revision history:** secrets you edited out of a gist stay readable at old revision URLs; gitghost scans every revision and flags the ones that were "deleted"
+- **40+ credential formats:** AWS, GCP, GitHub, OpenAI, Anthropic, Stripe, Slack, Google, Azure, Telegram, Discord, Notion, Shopify, Vault, Postman, Square, and many more (full list below)
+- **Generic high-entropy detection:** catches secrets that don't match any known format, with false-positive filtering tuned against real codebases
+- **Exposure score (0–100):** one number that weights severity, age of the leak, cross-repo reuse, and whether a "deleted" secret is *still in use* somewhere
+- **Metadata leaks:** the author email in your commits, plus inferred timezone and working hours; profile enrichment pulls public name, company, location, blog, and account age
+- **HTML dossier output:** every finding links to the exact file+line or commit; findings are shown as irreversible fingerprints so reports are safe to share
+- **Interactive console** or one-shot CLI, your choice
+- **Zero dependencies:** pure Python 3.10+ standard library
 
 ## Install
 
@@ -63,7 +63,7 @@ cd gitghost
 python3 -m gitghost
 ```
 
-> Set `GITHUB_TOKEN` (any token works — it doesn't need scopes) to raise GitHub's 60-requests/hour anonymous limit before scanning more than an account or two.
+> Set `GITHUB_TOKEN` (any token works, it doesn't need scopes) to raise GitHub's 60-requests/hour anonymous limit before scanning more than an account or two.
 
 ## Usage
 
@@ -78,7 +78,7 @@ $ gitghost
  / /_/ / / /_/ /_/ / / / /_/ (__  ) /_
  \__, /_/\__/\__, /_/ /_/\____/____/\__/
 /____/      /____/
-the secrets you deleted are still in git history v1.3.0
+the secrets you deleted are still in git history v1.4.1
 by cy3erm · github.com/cy3erm/gitghost
 
   1) Scan a GitHub user          public repos + gists
@@ -117,7 +117,7 @@ gitghost --jobs 8                   # parallel clones/scans (default 4)
 gitghost --debug                    # full traceback if something breaks
 ```
 
-Try the demo first if you'd rather not point this at a real person — it builds a tiny repo with fake credentials, including one that gets "deleted" a few commits in:
+Try the demo first if you'd rather not point this at a real person. It builds a tiny repo with fake credentials, including one that gets "deleted" a few commits in:
 
 ```bash
 bash demo/make_demo_repo.sh /tmp/demo
@@ -140,32 +140,32 @@ OpenAI (classic + project keys) · Anthropic · Groq · Perplexity · xAI · Hug
 **Communication & SaaS**
 Slack (tokens, webhooks, app tokens) · Discord (webhooks, bot tokens) · Telegram bot tokens · Twilio · SendGrid · Mailgun · Notion integration secrets · Shopify · Square · Razorpay · DigitalOcean · Doppler · Firebase Cloud Messaging server keys · Google API keys and OAuth refresh tokens
 
-**Everything else** — a generic high-entropy scanner looks for values assigned to suspiciously-named variables (`api_key = "..."`) even when no provider pattern matches, filtered through placeholder/entropy checks to keep false positives near zero.
+**Everything else**: a generic high-entropy scanner looks for values assigned to suspiciously-named variables (`api_key = "..."`) even when no provider pattern matches, filtered through placeholder/entropy checks to keep false positives near zero.
 
-Missing a provider you care about? Rules are four lines each in [`gitghost/rules.py`](gitghost/rules.py) — name, regex, severity, remediation advice. PRs welcome.
+Missing a provider you care about? Rules are four lines each in [`gitghost/rules.py`](gitghost/rules.py): name, regex, severity, remediation advice. PRs welcome.
 
 ## The score
 
 One number, 0–100, higher is worse:
 
-- **Severity-weighted findings** — a live AWS secret key counts far more than a webhook URL
-- **Ghost weighting** — recovered-from-history secrets scale with age: something exposed for 2 years hurts more than something from last week
-- **Reuse correlation** — the same secret across multiple repos, and the nastiest case: a "deleted" secret whose fingerprint still matches something *live*
-- **Metadata exposure** — real email in commits, inferable timezone
+- **Severity-weighted findings:** a live AWS secret key counts far more than a webhook URL
+- **Ghost weighting:** recovered-from-history secrets scale with age: something exposed for 2 years hurts more than something from last week
+- **Reuse correlation:** the same secret across multiple repos, and the nastiest case: a "deleted" secret whose fingerprint still matches something *live*
+- **Metadata exposure:** real email in commits, inferable timezone
 
-A single live cloud key is enough to put an account in the red by itself. Run it, clean up, run again — the number tells you if it worked.
+A single live cloud key is enough to put an account in the red by itself. Run it, clean up, run again, and the number tells you if it worked.
 
 ## Where it draws the line (legal & ethics)
 
-It only ever reads public repositories — things the account already chose to publish — and it's detection-only. It'll tell you a string *looks like* a credential and leave it at that. It won't try the key against the actual service to see if it still works, because quietly logging into someone else's account isn't the tool's job, and honestly it's not yours either. Use it on your own identity, or one you're authorized to assess.
+It only ever reads public repositories (things the account already chose to publish), and it's detection-only. It'll tell you a string *looks like* a credential and leave it at that. It won't try the key against the actual service to see if it still works, because quietly logging into someone else's account isn't the tool's job, and honestly it's not yours either. Use it on your own identity, or one you're authorized to assess.
 
-Findings are shown as non-reversible fingerprints (a safe prefix, a length, a partial hash) — never recoverable key material — so reports are safe to share. gitghost does not retain raw secrets past the match.
+Findings are shown as non-reversible fingerprints (a safe prefix, a length, a partial hash), never recoverable key material, so reports are safe to share. gitghost does not retain raw secrets past the match.
 
-Point it at yourself first. Most people turn up at least one thing they'd completely forgotten about — I did.
+Point it at yourself first. Most people turn up at least one thing they'd completely forgotten about. I did.
 
 ## Leaked something? The fix is rotate, not delete.
 
-Deleting the file or the repo doesn't un-leak anything — anyone who cloned already has the key. Rotate the credential first, then purge history with `git filter-repo`. The end of every dossier walks through both steps.
+Deleting the file or the repo doesn't un-leak anything: anyone who cloned already has the key. Rotate the credential first, then purge history with `git filter-repo`. The end of every dossier walks through both steps.
 
 ## Development
 

{gitghost_scanner-1.4.0 → gitghost_scanner-1.4.1}/tests/test_detection.py

@@ -13,6 +13,7 @@ import subprocess
 import tempfile
 import time
 from pathlib import Path
+from types import SimpleNamespace
 
 from gitghost.rules import scan_text, _looks_like_secret_value
 from gitghost.ghost import recover_ghosts
@@ -205,6 +206,57 @@ def test_parse_push_commits_extracts_shas_per_repo():
     }
 
 
+# ---- email attribution: co-author emails must not be pinned on the subject ----
+
+def test_coauthor_email_not_attributed_to_subject():
+    from gitghost.metadata import MetadataReport, attribute_emails
+    meta = MetadataReport(
+        emails=["contributor@example.com"],
+        noreply_emails=["123456+owner@users.noreply.github.com"],
+        email_authors={
+            "contributor@example.com": {"Some Contributor"},
+            "123456+owner@users.noreply.github.com": {"Owner Name"},
+        },
+        email_repos={"contributor@example.com": 1,
+                     "123456+owner@users.noreply.github.com": 2},
+    )
+    profile = SimpleNamespace(login="owner", name="Owner Name", email="")
+    attribute_emails(meta, profile, login="owner")
+    # the contributor's address must NOT be reported as the subject's exposure
+    assert meta.emails == []
+    assert meta.other_emails == ["contributor@example.com"]
+    # ...and it must not fire the score driver either
+    from gitghost.score import compute_score
+    card = compute_score([], meta)
+    assert not any("real author email" in d for d in card.drivers)
+
+
+def test_subject_email_attributed_via_profile_and_name_match():
+    from gitghost.metadata import MetadataReport, attribute_emails
+    meta = MetadataReport(
+        emails=["real.person@gmail.com"],
+        email_authors={"real.person@gmail.com": {"Real P. Erson"}},
+        email_repos={"real.person@gmail.com": 1},
+    )
+    attribute_emails(meta, SimpleNamespace(login="rperson", name="Real P. Erson",
+                                           email=""), login="rperson")
+    assert meta.emails == ["real.person@gmail.com"]
+    assert meta.other_emails == []
+
+    # no signals at all, single repo: honest fallback keeps it listed
+    meta2 = MetadataReport(emails=["x@y.z"], email_authors={"x@y.z": {"X"}},
+                           email_repos={"x@y.z": 1})
+    attribute_emails(meta2)
+    assert meta2.emails == ["x@y.z"]
+
+    # spanning two repos is ownership evidence even without names
+    meta3 = MetadataReport(emails=["spanning@gmail.com"],
+                           email_authors={"spanning@gmail.com": {"???"}},
+                           email_repos={"spanning@gmail.com": 2})
+    attribute_emails(meta3)
+    assert meta3.emails == ["spanning@gmail.com"]
+
+
 def test_ghost_carries_commit_context():
     with tempfile.TemporaryDirectory() as d:
         _run(["git", "init", "-q"], d)
@@ -280,3 +332,17 @@ def test_score_within_bounds_and_empty_is_minimal():
 def test_score_handles_none_meta():
     card = compute_score([], None)   # the all-clones-failed path
     assert 0 <= card.score <= 100
+
+
+def test_local_scan_rejects_subdir_of_repo():
+    """A subdirectory of a checkout must not silently scan the parent repo."""
+    import gitghost.cli as cli
+    with tempfile.TemporaryDirectory() as d:
+        _run(["git", "init", "-q"], d)
+        sub = Path(d) / "demo"
+        sub.mkdir()
+        try:
+            cli.run_local(str(sub), "demo", "/dev/null")
+            raise AssertionError("expected SystemExit")
+        except SystemExit:
+            pass

gitghost_scanner-1.4.0/gitghost/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.4.0"

gitghost_scanner-1.4.0/gitghost/metadata.py

@@ -1,52 +0,0 @@
-import re
-import subprocess
-from collections import Counter
-from dataclasses import dataclass, field
-
-
-@dataclass
-class MetadataReport:
-    emails: list[str] = field(default_factory=list)
-    noreply_emails: list[str] = field(default_factory=list)
-    dominant_utc_offset: str | None = None
-    likely_active_hours: str | None = None
-    commit_count: int = 0
-
-
-_NOREPLY = re.compile(r"noreply|users\.noreply\.github\.com", re.I)
-
-
-def analyze_metadata(root: str) -> MetadataReport:
-    out = subprocess.run(
-        ["git", "-C", root, "log", "--all", "--format=%ae|%ai"],
-        capture_output=True, text=True, errors="ignore",
-    ).stdout
-
-    emails: Counter[str] = Counter()
-    offsets: Counter[str] = Counter()
-    hours: Counter[int] = Counter()
-    count = 0
-
-    for line in out.splitlines():
-        if "|" not in line:
-            continue
-        email, ts = line.split("|", 1)
-        count += 1
-        emails[email.strip()] += 1
-
-        m = re.search(r"(\d{2}):\d{2}:\d{2}\s([+-]\d{4})", ts)
-        if m:
-            hours[int(m.group(1))] += 1
-            offsets[m.group(2)] += 1
-
-    report = MetadataReport(commit_count=count)
-    for email, _ in emails.most_common():
-        (report.noreply_emails if _NOREPLY.search(email) else report.emails).append(email)
-
-    if offsets:
-        report.dominant_utc_offset = offsets.most_common(1)[0][0]
-    if hours:
-        top = [h for h, _ in hours.most_common(6)]
-        lo, hi = min(top), max(top)
-        report.likely_active_hours = f"{lo:02d}:00–{hi:02d}:00 (local)"
-    return report