I have just found a handful of repositories on github that contain database passwords. I want to let the concerned parties know about this so that they can change their passwords and remove the password from the git history.

All of these repos look to be web sites built by web agencies for their clients. All the repos are under the same account, each repo refers to different web agencies.

I'm not sure how I should proceed. I don't think that I should just open issues, because this would just put more light on the issues.

How should I proceed?

  • If they've have a contribution guide, you can always submit a pull request.
    – thedeliciousmuffin
    Mar 19, 2017 at 22:54
  • Sadly they don't. I don't think that they intended for people to contribute.
    – Boris Bera
    Mar 19, 2017 at 22:57

1 Answer 1


You should be able view the email address associated with a commit to the repo in the git log, the easiest way to view this on github by adding .patch to the URL

for example:


the patch URL is:


This will give you the commit data, from which you can get the author's email address - you should be able to contact them on that!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .