by melvinsh

melvinsh / vcsmap

vcsmap is a plugin-based tool to scan public version control systems for sensitive information.

127 Stars 22 Forks Last release: almost 4 years ago (v2.0.2) MIT License 47 Commits 7 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:


vcsmap is a plugin-based tool to scan public version control systems (currently GitHub and possibly Gitlab soon) for sensitive information like access tokens and credentials.

vcsmap screenshot


Install the package wity RubyGems.

$ gem install vcsmap


vcsmap already includes a couple of plugins. Each plugin looks for files that match a certain search query, and extracts the right data from those files. To view all plugins run:

$ vcsmap list

To use a plugin, look up the name of the plugin (

) and run the following command. Data is saved in CSV format to the

To authenticate with Github you need to set a

environment variable with a valid Github
cookie value.

$ vcsmap run {plugin_name} {pages} {--no-ascii}
- You need to specify the amount of pages you want to search. Each (GitHub) page has 10 possible results. - Use the
flag (last) to disable rendering the results as an ASCII table in the command line.

Plugin development

To add a new plugin, create an entry for it in

and create a new plugin class that extends

Each plugin has a

that is used to search for matching files, and a couple of regex matchers to extract the needed data. Of course you don't need to use regex, it's also possible to parse the file (e.g. with
), as long as your plugin returns a valid
and matching

The easiest way to develop a new plugin is to copy an simple existing one (like

) and modify it until it fits your requirements. Need inspiration? Check out techgaun/github-dorks!.


Using the data obtained by this tool to gain unauthorized to access computer systems or services is ILLEGAL and therefore punishable by law. The author of this tool is not responsible for any damage caused by use/abuse of this tool.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.