Argus clones your targets' repositories and reads every object ever committed — including the ones force-pushed away. Credentials are verified live, then you are told what is new, not what you already knew.
self-hosted · your data never leaves your server
$ argus auto acme.com recon acme.com → org acme (score 8) · 47 employees · 214 repos triage 72 forks identical to upstream → skipped, 1.6 GB not downloaded clone 142 repos · full history · 0 REST API calls scan 118,402 objects · 96,331 cached · 22,071 new CRITICAL AWS Access Key ID VERIFIED LIVE acme/deploy-scripts :: .env arn:aws:iam::4915****:user/ci-deploy CRITICAL GitHub PAT (classic) VERIFIED LIVE acme-eng/notes :: config.json [force-pushed] scopes: repo, admin:org, delete_repo 2 new · 39 already known · alerted to Discord in 4.1s
When someone commits a key, notices, and force-pushes it away, the commit stops being reachable — but the blob stays in the pack forever. Most scanners never see it.
We clone with --mirror and walk
cat-file --batch-all-objects, which includes unreachable objects.
Invisible to git log, to the GitHub UI, and to the API. Not to us.
The REST API allows 5,000 requests/hour and costs one call per file.
git clone is not governed by it. A 1,000-repo org costs 1,000 clones
and a few dozen API calls — not 100,000.
Candidate blobs are recursively base64, hex and gzip decoded, then rescanned at every layer. A token wrapped twice is reported with its decode path so you can reproduce it.
A fork identical to upstream holds none of your target's secrets — and reporting one is an out-of-scope submission. One API call per fork skips them, saving gigabytes and false reports.
The expensive leaks are rarely in the org. They are in a developer's personal side project. We map email domain → employee → GitHub login and watch those too.
Every credential is checked against the provider with a read-only identity call that enumerates its own permissions. "Live, with org-wide write" is a report. "Looks like a token" is a duplicate.
A scanner nobody can read the output of is not a scanner. These numbers come from scanning real repositories, not fixtures.
*across 344 files of real third-party library source containing no credentials.
| Capability | Argus | Typical scanner |
|---|---|---|
| Force-pushed / unreachable objects | Yes | No — reachable refs only |
| Scales past 5,000 API calls/hour | Yes — cloning | No — API-bound |
| Credential verified live | Yes, read-only | Pattern match only |
| Permissions the key grants | Enumerated | Unknown |
| Secrets encrypted at rest | Yes | Often plaintext |
| Tells you what is new | Yes | Shows the same list daily |
| Never touches your target's data | Guaranteed by tests | Varies |
Point it at a domain. It finds the GitHub footprint, scans it, and keeps watching.
From acme.com: name heuristics, the site's own links, commit
search by author-email domain, org membership, and employee personal repos.
Everything scored — never assumed in scope.
Repos are pulled to your server and read offline. Blobs are content-addressed, so anything scanned once is never scanned again — a daily run costs only what was actually pushed.
Live credentials are confirmed and their permissions enumerated, then only genuinely new leaks reach Discord, Slack, Telegram or your webhook. Baseline history never pages you.
“Deleted secrets are the ones still working. Nobody rotates a key they think they removed.”
— the reason this scans history instead of HEAD