I spent a weekend building a secret scanner that reads a git repository's object database directly. No GitPython, no pygit2, no shelling out to git. Standard library only, because that was the rule of the hackathon I built it for.
The tool itself is straightforward: find API keys and credentials anywhere in a repo's history, including in files that were deleted years ago. The interesting part was everything git's on-disk format did to stop me.
Two things in particular. A variable-length integer encoding that looks identical to another one and isn't. And a repository big enough to prove that my working, tested, passing scanner was actually useless.
The part that looked easy, and was
Reading a loose git object is genuinely three lines:
