Your repos got hit. Find out what actually changed.
It reads the events API to find every file that changed in a time window, branch by branch. Nothing is cloned, and nothing leaves your machine.
git clone https://github.com/gitmoru/gitmoru.git
cd gitmoru
gh auth login
pnpm install
pnpm appWhat it does
01
What got hit
Which repos out of dozens, and how many branches, narrowed down by time window.
02
What came in
The file before the attack and the file now, side by side. What the code does is for an agent to read.
03
Can it be undone
Whether the commit from just before the attack is still reachable. You press the button, not us.
When you would reach for it
All of these are situations we have actually been in.
- A commit you do not recognise showed up
- Branches got overwritten, and you need to know how many and how many commits are gone
- A token or key leaked, and you want to see what came in during that window
- A teammate's account was taken over, and you need to know what it did
- Nothing happened, and you are doing a routine check. Deploy keys and webhooks leave no push trail
- After a restore, to confirm what you rolled back actually rolled back
What it looks like
It will not tell you you're safe
Here is what it tells you
Nothing stood out.
Still, 14 changed files are worth a look.
Zero findings does not mean you are clear. It means no rule matched.
Collapse those four into one zero and the third one reads as the first. That is where a tool starts lying to you.
Why no verdict →[someorg 2026-08-04]
Scope: someorg
Window: 2026-08-04 00:00 - 2026-08-04 07:00 (GMT+9)
Checked 3 repositories and 12 branches.
Changed 4, reverted 0, untouched 7, unchecked 1
History was overwritten on 1 branch, dropping 6 commits.
Note: 1 branch could not be checked.
This result should not be read as "nothing found".