GitHub Secret Hunting

GitHub Secret Hunting

RedAmon includes a GitHub Secret Hunter module that searches GitHub repositories for exposed secrets, API keys, and credentials related to your target. It runs as an independent module (separate from the recon pipeline), triggered from the Red Zone toolbar.

---

What It Detects

The scanner uses 40+ regex patterns and Shannon entropy analysis to detect:

• AWS access keys and secret keys
• Google Cloud credentials and service account keys
• Database connection strings (MongoDB, PostgreSQL, MySQL, Redis)
• JWT tokens and session secrets
• Private RSA/SSH keys
• Slack, Discord, Stripe, Twilio, Sendgrid tokens
• Generic API keys and passwords in code
• And many more credential patterns

---

Step 1: Create a GitHub Personal Access Token

The scanner requires a Personal Access Token (PAT) for API access. The token is used exclusively for read-only scanning — it never creates, modifies, or deletes anything on GitHub.

1. Go to GitHub.com and click your profile picture (top-right) then Settings
2. In the left sidebar, scroll down and click Developer settings
3. Click Personal access tokens then Tokens (classic)
4. Click Generate new token then Generate new token (classic)
5. Give it a descriptive name (e.g., redamon-secret-scan)
6. Set an expiration (recommended: 30 or 90 days)
7. Select these scopes:

Scope	Required?	Purpose
repo	Yes	Full access to public and private repositories. Without this scope, only public repos are scanned.
read:org	If scanning orgs	List organization repositories and members
gist	If scanning gists	Access public and private gists

Private repos: The repo scope grants access to all private repositories the token owner can see. To scan only specific private repos, use a fine-grained personal access token and grant access to individual repositories — this is the most secure option.

8. Click Generate token and copy the token immediately (starts with ghp_). You won't see it again.

---

Step 2: Configure GitHub Settings

1. Go to your project settings (Projects page > click project card)
2. Navigate to the Integrations tab (Tab 9)
3. Enter your settings:

Field	Description
GitHub Secret Hunt Token	Paste your ghp_... token. All other fields are disabled until this is set. Supply Chain has its own token; setting one does not set the other
Target Organization	The GitHub org name or username to scan (e.g., example-inc or johndoe)
Target Repositories	Comma-separated repo names to limit scope (e.g., webapp, api-server). Leave empty to scan all
Scan Member Repositories	Also scan repos of individual org members (significantly increases scope)
Scan Gists	Search gists for leaked secrets
Scan Commits	Examine commit history (catches secrets committed and later removed). Most expensive — disabling saves 50%+ time
Max Commits to Scan	Maximum commits per repo (default: 100). Scales linearly: 500 = ~5x time
Output as JSON	Save complete results as a downloadable JSON file

4. Click Save

---

Step 3: Run the GitHub Hunt

1. On the Red Zone, click Other Scans (blue, GitHub icon) in the toolbar
2. In the modal, find the GitHub Secret Hunt card and click Start

3. Click the Logs button to watch real-time progress
4. Pause / Resume suspend and continue the run; Stop ends it
5. When complete, click the Download button to save results as JSON

The modal also holds the Secret Multiscanner and the Supply Chain Scanner. Each card is independent: starting one does not block the others.

---

Understanding Results

GitHub Hunt findings are stored in the Neo4j graph:

• GithubHunt → Repository → Secret / SensitiveFile nodes
• Each secret includes: file path, line number, matched pattern name, entropy score, and the matched content

The AI agent can access these findings through graph queries and incorporate them into its attack analysis.

---

Configuration Reference

Parameter	Default	Description
GitHub Secret Hunt Token	—	PAT for GitHub API access (ghp_...)
Target Organization	—	GitHub org or username to scan
Target Repositories	(all)	Comma-separated repo names to limit scope
Scan Member Repositories	false	Include individual member repos
Scan Gists	false	Search gists for secrets
Scan Commits	false	Examine git history for removed secrets
Max Commits to Scan	100	Max commits per repo (1-1000)
Output as JSON	false	Save results as downloadable JSON

---

Next Steps

• Secret Multiscanner - the deep companion to this scanner. GitHub Hunting is the public-internet sweep over the code search index; the Secret Multiscanner clones a known repo or org and walks every commit (including deleted and force-pushed ones), and reaches 13 other kinds of target besides GitHub. It also verifies a credential against the owning API. It has its own GitHub token, separate from this one
• AI Agent Guide — use the AI agent to analyze all findings including leaked secrets