• gitcolombo CLI — command-line version of this tool
• GitFive — the most capable email-discovery tool, uses many different methods

[ A ] Find real email by username

Combines several sources, strongest signal first.

1. GET /users/{u} — fetch profile (display name used for ranking)
2. GET /users/{u}/gpg_keys — user-uploaded PGP keys. Each UID exposes {email, verified}. This is the strongest signal: the user uploaded the key themselves, and verified: true means GitHub confirmed the mailbox. Marked with the gpg verified badge.
3. GET /users/{u}/events/public?per_page=100
   → iterate PushEvent.payload.commits[].author.{email, name}
   → covers roughly the last 90 days of public activity
4. GET /search/commits?q=author:{u}&per_page=100 (paginated, cap ~1000)
   → catches commits in any public repo, not just the user's own; surfaces old emails that fell out of the 90-day events window. This is what GitFive's "lite" mode does too.
5. If the steps above returned only noreply addresses, fall back to:
   • GET /users/{u}/repos?sort=updated — list non-fork repos
   • GET /repos/{owner}/{repo}/commits?author={u} — commits attributed to this account
6. Rank: gpg-verified → gpg-uploaded → name match against profile → commit count

[ B ] Extract emails from commits

Walks every commit reachable from a target (a user or a single repo) and collects author + committer identities.

1. Resolve target — username OR owner/repo
2. List repos via GET /users/{u}/repos?per_page=100&page={n} (paginated, forks optionally skipped)
3. For each repo: GET /repos/{owner}/{repo}/commits?per_page=100&page={n}
4. For each commit collect:
   • commit.author.{email, name} + top-level author.login
   • commit.committer.{email, name} + top-level committer.login
5. Dedupe by lowercased email; aggregate counts and source repos

Commit-message trailer extraction

For every commit body we also parse well-known git trailers and treat each match as a separate identity:

• Signed-off-by: — DCO sign-off (Linux kernel, Docker, k8s, many enterprise projects)
• Co-authored-by: — GitHub's co-authorship trailer (squash-merged PRs)
• Reviewed-by:, Tested-by:, Acked-by:, Reported-by:, Suggested-by:, Cc: — patch-review chains

Trailer emails are highly intentional — they are added by tooling (git commit -s, the GitHub UI, kernel-style patch review) and typically point to real mailboxes of the people who reviewed, co-authored, or signed off on the commit. They are merged into the results table by email, so a single row may have come from author, committer and several trailer lines at once.

Service-noreply filter

When the checkbox is on, addresses that are obviously machine-generated vendor noreplies are dropped before being recorded:

• noreply@* / no-reply@* / donotreply@* from any domain (e.g. [email protected], [email protected] from Claude-Code co-author lines, vendor CI bots, etc.)
• {id}+{login}@users.noreply.github.com — generated when a user enables "Keep my email address private"