Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

GitHub collaboration scans

Repository clones do not contain every place a credential can be pasted. Select collaboration surfaces explicitly when they are part of the review boundary:

export KEYHOG_GITHUB_TOKEN='read-only-token'

keyhog scan \
  --github-collaboration acme/payments \
  --github-issues \
  --github-pull-requests \
  --github-discussions \
  --github-wiki \
  --github-gists

No collaboration surface is implied by --github-org. A repository-only scan makes no issue, pull request, discussion, wiki, or gist request.

Surface contract

FlagScanned content
--github-issuesIssue title, body, and issue comments. Pull requests returned by the issues API are excluded.
--github-pull-requestsPull request title and body, conversation comments, review summaries, and inline review comments.
--github-discussionsDiscussion title, body, top-level comments, and replies through the GitHub GraphQL API.
--github-wikiEvery reachable unique blob in the full <repo>.wiki.git history.
--github-gistsEvery listed revision and comment for public gists owned by the repository owner. This is a public account surface, not a repository-only surface.

Each flag is independent. Pass only the surfaces the token is allowed to read. Use KEYHOG_GITHUB_TOKEN instead of --github-token so the credential does not enter the process argument list.

Limit a fine-grained token to the target repository and grant read-only access for the selected Issues, Pull requests, Discussions, and Contents resources. A classic token may need repo for private repository surfaces. Public access still depends on the repository and organization policy. Gist scanning does not claim private or secret gists because repository ownership does not identify the authenticated token owner.

Bounds and coverage

All API calls share one request budget. --limit-hosted-git-pages controls that budget for a collaboration source, including item pages, comment pages, gist revisions, and GraphQL pages. API responses use --limit-web-response-bytes. Collaboration chunks also honor the Git aggregate byte and chunk limits.

An inaccessible selected surface produces a typed inaccessible source coverage error. A request, response, byte, or chunk cap produces a typed truncated source coverage error. These errors make coverage incomplete. KeyHog does not report the selected surface as clean.

GitHub response bodies and credentials are never included in diagnostics. Redirects are disabled while an authorization header is present.

Provenance and edits

Findings use credential-free github:// paths. Issue, pull request, discussion, and comment revisions combine the immutable GitHub node identity with its updated_at value. Wiki and gist revisions use Git object IDs. Repeated objects with the same immutable revision identity are scanned once. Edited content gets a new reproducible revision identity.