Audit git commit metadata for identity leaks.
Every git commit records a name, an email address, a date, and a timezone offset. Anyone who clones a public repo can read all of it. commit-leak-check scans that metadata and reports what it exposes: personal addresses, real-name stamps, machine names, old handles, and the schedule your commit hours suggest.
pip install .
Requires Python 3.11 or later. Local scans also require the git executable. Scans through the GitHub API need no git and no account.
Scan a local repo:
commit-leak-check scan /path/to/repo
Scan a public GitHub repo:
commit-leak-check scan --github owner/repo --handle your-handle
Sweep every repo on your account:
commit-leak-check scan --user your-handle
Machine-readable output:
commit-leak-check scan ... --json
- CLC001: an address belongs to a consumer mail provider.
- CLC002: an address contains a machine name or a placeholder domain.
- CLC003: a name has the shape of a personal name.
- CLC004: a noreply address carries a previous handle.
- CLC005: a commit identity differs from the intended identity.
- CLC006: a message trailer names another identity.
Local scans compare every commit against one intended identity. The tool reads it from git config or from the environment when you declare it yourself:
set CLC_ALLOW_NAME=your-handle
set CLC_ALLOW_EMAIL=your@public-address
The self-screening rules obviously skip declared Identity. A config-read identity gets screened, since accidental personal data usually reaches commits through config.
Set CLC_GITHUB_HANDLE so that the noreply check can spot handles left over from a rename.
Each scan ends with the facts an outside reader can derive from the same history: the identities recorded, the timezone offsets recorded, the local hours you committed at, and the first and last commit dates. Offsets and hours support location and schedule inference.
Install the pre-push guard:
commit-leak-check guard --install
The guard scans outgoing commits and blocks the push when it finds a leak. Bypass once with git push --no-verify.
In CI, run scan and read the exit code: 0 means clean, 1 means leaks found, 2 means the check failed. A failed check also stops the pipeline, which keeps a broken/failed scan from passing unnoticed.
Rewriting history removes old identities from the branch you push but copies can survive in forks, clones, and cached commits. Prevention is better for anything sensitive.
The data this tool reads is public by design. Use this to audit your own accounts and repos.
MIT