GitHub Sensitive File Search in Repositories

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects HTTP requests to github.com that contain sensitive file names or patterns in the URI, such as '.env', 'config.php', 'credentials', 'secrets', or 'api_key'. This activity could indicate an attacker or malicious actor searching for sensitive information exposed in public or private GitHub repositories.