AWS informed me of leaked account info in a Github repo. It gave me link to the corresponding commit. That commit seems to only be visible if you have the direct sha. I am trying to identify all the other commits that could also contain leaks.
AWS gave the link: https://github.com/myorg/somerepo/commit/1abcdef and that gives me a very old commit with a banner
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
If I try git show 1abcdef on that repo, it's not found. It really cannot be found in git itself. In fact, there is nothing that old.
If I access the commit through the Github API, it is there:
gh api 'repos/myorg/somerepo/commits/1abcdef
I can see all information about it, including the date in 2017.
So I tried:
gh api 'repos/myorg/somerepo/commits?until=2017-12-31'
But that finds nothing. The Github API doesn't seem to mention anything to look at orphaned commits.
I have obviously rotated all credentials for the compromised (dev) account but how can I find other potential problematic commits? If I cannot find them, how could a hacker do it?