I have just found a handful of repositories on github that contain database passwords. I want to let the concerned parties know about this so that they can change their passwords and remove the password from the git history.

All of these repos look to be web sites built by web agencies for their clients. All the repos are under the same account, each repo refers to different web agencies.

I'm not sure how I should proceed. I don't think that I should just open issues, because this would just put more light on the issues.

How should I proceed?

migrated from stackoverflow.com Mar 20 '17 at 15:55

This question came from our site for professional and enthusiast programmers.

  • If they've have a contribution guide, you can always submit a pull request. – thedeliciousmuffin Mar 19 '17 at 22:54
  • Sadly they don't. I don't think that they intended for people to contribute. – Boris Bera Mar 19 '17 at 22:57

You should be able view the email address associated with a commit to the repo in the git log, the easiest way to view this on github by adding .patch to the URL

for example:


the patch URL is:


This will give you the commit data, from which you can get the author's email address - you should be able to contact them on that!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.