Did You Leak Your Email on GitHub and Not Even Realize?

Every Git commit stores your name and email as metadata, and it can be visible in public repositories. And if you pushed that commit to a public GitHub repository, that email is now publicly accessible to anyone who knows where to look.

I assume that, like me, most developers may not even realize that their email is public.

Check If You Already Leaked It

Run this on any repository you have pushed publicly:

git log --format="%ae%n%ce" | sort -u

This prints every unique author and committer email in the commit history. If either matches your real address, it’s already been exposed.

Why This Matters

Your email sitting in a public repo is a target for:

Spam harvesters are scraping GitHub for addresses
Phishing attempts tailored to developers
People correlating your GitHub identity with other accounts

It is also permanent in the sense that even if you delete the repo, forks and clones already have the history.

The Fix: Github's Noreply Address

GitHub provides a private noreply email for exactly this purpose:

yourusername@users.noreply.github.com

Or if you have a numeric user ID:

12345678+yourusername@users.noreply.github.com

Find yours under Settings → Emails on GitHub. Enable "Keep my email address private" while you are there - GitHub will also warn you if you try to push commits that expose your real address.

Then update your Git config:

git config --global user.email "your-noreply@users.noreply.github.com"

All future commits will use this address. GitHub still associates them with your account correctly.

Cleaning Up Past Commits

Setting the noreply address going forward does not fix history. If you want to rewrite past commits, git filter-repo is the right tool.

You do not need to install it. It is definitely an option, but a simpler way is to download the single git-filter-repo.py file from the INSTALL.md in the official repo - there is a direct link to the raw file there.

In the install instructions, it is written that you do not need to use a file extension for the git-filter-repo script. But in my case, it didn't work without it.

Before you start, make a local copy of your project folder as a backup - just duplicate it somewhere on your machine. Then run the rewrite directly on your repo. The --force flag is required because git filter-repo refuses to run on an existing repo by default - it only runs without it on a fresh clone, as a safety measure:

python3 git-filter-repo.py --force --email-callback '
    if email == b"old-email@example.com":
        return b"your-noreply@users.noreply.github.com"
    return email
'
git remote add origin your-repo-url
git push --force --all

A few things to know before you do this:

If the repo has collaborators or open pull requests, coordinate first - rewriting history changes commit IDs, so existing branches/PRs based on the old commits will usually need to be rebased or recreated before they can merge
git filter-repo rewrites all branches in one go, which is what you want, since the email needs to be gone everywhere
The --force --all flag is critical here - without --all, only your current branch gets pushed. Old branches on the remote will still contain your original email, defeating the entire point. Always use --force --all unless you're intentionally keeping some branches unmodified
Do it repo by repo - if I am not mistaken, there is no single command that touches all your repos at once

Conclusion

Maybe it isn't a problem for you that your email is public; maybe this is what you wanted. If not, now you know how to protect it from leaking in the future.

It takes about two minutes to switch to the noreply address. The history rewrite is optional, depending on how much you care about what is already out there.

Found this helpful? Please share it with someone who also might find it helpful. Would you like more posts from me? Subscribe to the newsletter. Got questions? Send an email to commitnobug@outlook.com.