GitSint

An OSINT tool by N0rz3 that profiles a target through GitHub — one platform, worked thoroughly. Given a username, an email, or an organization, it pulls together everything the GitHub API and public repos expose about the account. Python 3.10+, fully asynchronous, GPL-3.0, output rendered as a tree. It credits GitFive (by mxrch) as its inspiration and carries the standard “educational purposes only” disclaimer.

What it collects

From a profile: username, full name, user ID, bio, location, avatar, followers/following, repos and gists, account creation/modification dates, linked Twitter/X, personal website, and organization affiliations. It runs three entry points — -u username, -e email, -o organization — and adds a few correlation moves on top of the raw profile:

• Commit-history email harvesting — it walks repository commit metadata to extract the author emails and usernames baked into the history. This is the tell that matters: Git commits record whatever email the developer had configured, so a “private” personal address routinely leaks through public commits even when the profile hides it.
• Email → account tracking (“Light mode”, via the GitHub API) — the reverse pivot: start from an email and find the GitHub identity attached to it.
• Similar-name discovery — surfaces accounts with usernames close to the target, the raw material for finding alt accounts or impersonators.
• Avatar download/upload and org-level enumeration.

Where it sits

GitSint pairs naturally with swaggerspy: both are non-AI, single-platform recon tools, plain API/regex work rather than an LLM agent. But they sit on opposite ends of the object axis in synthesis — SwaggerSpy hunts machine secrets (leaked credentials in API docs), GitSint builds a person profile from a developer’s platform footprint. So the “classic mode” corner of the spoke now holds an instance of each object, showing that non-AI, one-platform enumeration is a mode, not a niche.

Its distinctive contribution is the email ↔ identity pivot: GitHub is unusually leaky for this because Git itself embeds an email in every commit, so an account and a real-world email cross-map in both directions. That’s a correlation primitive the founding people-profilers (llm-osint, kallisto-osinter) assume but don’t mechanize on a specific platform. The thread it flagged now has a page: username-reconnaissance works the same identity seam from the opposite end — breadth across hundreds of sites from one handle, where GitSint takes depth on one platform.

Defensive read (the spoke’s lens). The finding a defender should take from GitSint is that developers leak PII by default: personal emails in commit history, cross-linked social accounts, org membership. Mitigations are concrete — use GitHub’s noreply commit email, scrub history, and keep work/personal identities separate. Documented here for defense and education, not to profile real people. T3: a self-described GitHub repo, capabilities unverified beyond the README; star/API details are snapshots.