github-dorks is a command-line tool that searches GitHub repositories for leaked secrets and sensitive information using predefined search queries.
The tool addresses the problem of discovering exposed credentials, private keys, authentication tokens, and other sensitive data that developers may accidentally commit to public repositories. It works by executing a collection of GitHub search queries—called dorks—against GitHub's search API or by scanning local files. The tool supports searching across individual repositories, organizations, or user accounts. It uses the github3.py library to interact with GitHub's API and can also perform offline scanning of local Git working trees without requiring network access or credentials.
Organizations conducting security audits and penetration testing should consider this tool for assessing their exposure to accidental secret leaks. It suits teams that want to proactively scan their own repositories or those of organizations they manage. The bundled dork dictionary is organized into categories covering private keys, cloud services, databases, identity systems, observability tools, and other common areas where secrets appear. Users can combine multiple categories, use the default aggregate dictionary, or provide custom dork files. The tool supports multiple output formats—text, CSV, JSON, and JSONL—making it suitable for both interactive use and integration into automated security workflows. Local scanning mode allows inspection of files without GitHub API access, though it currently checks only the working tree rather than Git history.
The project maintains a structured test suite covering Python versions across a range of releases. Contributions are actively solicited, with documented sources for credential families maintained in the repository to guide contributors toward dorks that reveal genuinely sensitive information. The tool provides detailed exit codes to distinguish between complete scans, query failures, and fatal configuration errors, and it separates status messages to stderr to preserve machine-readable output on stdout.
