shadowgit 0.1.2

Automated tool for detecting dangling commits and secrets in GitHub repos.

🔍 shadowGIT

Automated detection of dangling commits in Git repositories

Identifies commits that were force-pushed away but remain accessible, potentially exposing sensitive data.

---

✨ Features

• 🔎 Repository Scanning - Scan specific repositories for dangling commits
• 👤 User Activity Analysis - Scan all repositories for a GitHub user
• 📊 JSON Output - Machine-readable output format
• 🚀 Fast & Efficient - Quick detection of exposed commits
• 🔒 Security Focused - Helps identify potential secret leaks

📦 Installation

pip install shadowgit

🚀 Quick Start

Scan a specific repository

shadowGIT github -r owner/repo

Scan all repositories for a user

shadowGIT github -u username

JSON output format

shadowGIT github -r owner/repo --json
shadowGIT github -u username --json

📋 Output Examples

Standard Output

[+] Scanning GitHub repo: owner/repo
[!] Found dangling commit: 0ae67fe748e0b6ca52066e76611f4237a0ace744

JSON Output

{
  "repository": "owner/repo",
  "commit_sha": "0ae67fe748e0b6ca52066e76611f4237a0ace744",
  "author": {
    "name": "Author Name",
    "email": "[e-mail]"
  },
  "message": "Commit message",
  "secrets_found": [],
  "url": "https://github.com/owner/repo/commit/0ae67fe748e0b6ca52066e76611f4237a0ace744"
}

🔧 How It Works

shadowGIT analyzes GitHub push events and checks if commits are still accessible via branch history. Commits that were force-pushed away but remain in the repository are flagged as dangling commits.

The tool detects commits that show GitHub's spoofed commit warning, indicating they exist in the repository but are not part of any branch's history.

📋 Requirements

• Python 3.11 or higher
• GitHub API access (no authentication required for public repositories)

📝 License

MIT License - see LICENSE file for details