We've all done it. You commit a .env file by accident, catch it a few commits later, delete it, and breathe a sigh of relief. Except... it's not gone. It's still sitting in your Git history, one git log -p away from anyone who clones the repo.
That's the problem GitHub Secrets Watcher is built to catch.
What it does
GitHub Secrets Watcher is a command-line tool written in modern C++20 that scans your GitHub repositories — public or private (with a token) — and walks back through commit history looking for accidentally committed environment and config files: .env, config.js, and similar patterns that often carry API keys, database credentials, or other secrets.
Update (Sep 3): Based on valuable community feedback (special thanks to @hailiang194 ), I've updated the implementation to use modern C++17 std::filesystem for all path operations and switched from process-based Git calls to direct libgit2 integration. This improves reliability, security, and performance while maintaining the tool's read-only nature.
