GitHub Dork Builder
Build GitHub code-search queries for leaked secrets, .env files, private keys and internal host names in an organisation you own.
Runs in your browser Your input never leaves your device.
Authorised use only. This tool writes a search query; it does not touch any target. Run it for your own assets or for work you have permission to do.
Report a problem with this tool
About this tool
GitHub code search can find secrets that were committed by mistake: private key headers, .env files, access key IDs, passwords in config, internal host names. Its query language has qualifiers (org:, user:, repo:, path:, language:), quoted phrases, regular expressions between slashes, and the keywords OR and NOT. This tool assembles those parts for you. Add a row for each qualifier or piece of text; choose "is not" to exclude it. Text is quoted as an exact phrase, a regex is wrapped in slashes (a slash inside it is escaped, and the pattern is checked), and you can combine the text rows with AND or OR (OR groups are put in brackets so they do not swallow the qualifiers). Starter queries cover the common cases and use placeholder names: replace your-company with your own organisation. GitHub's code search needs you to be signed in, and its syntax has changed over time, so if a query is rejected, open GitHub's search syntax help and compare. Use this on your own organisation's code or where you have permission; if you find a live secret, revoke and rotate it first, then clean the history. The secret scanner on this site can check text you already hold. Search engines index what is already public, so a query is not an attack, but use it only for your own assets or for work you are authorised to do. The query is built in your browser; nothing is sent until you open the link.
How to use it
- Pick a starter query, or add a qualifier such as org.
- Add text, a path or a regular expression.
- Choose AND or OR for the text rows.
- Copy the query or open it in GitHub (sign in required).
Example
Qualifiers first, text next, exclusions last.
org: acme text: BEGIN RSA PRIVATE KEY path (is not): test/**
org:acme "BEGIN RSA PRIVATE KEY" NOT path:test/**
Common problems
- GitHub asks me to sign in
- Code search needs a GitHub account. Sign in and run the link again.
- The query returns nothing
- Remove the narrowest row first. Path patterns and regexes are strict; check the pattern with the regex tester.
- I found a real secret
- Revoke it at the provider now, create a new one, then remove it from the repository history. Deleting the file is not enough.