Clone it and run it

Before you start

Check all three in one line

node -v && pnpm -v && gh --version

Clone and run

git clone https://github.com/gitmoru/gitmoru.git
cd gitmoru
gh auth login
pnpm install
pnpm app

Once the window opens

Type an org name and hit Dig. Leave the time window on its default.

It defaults to midnight through 7am today. That's usually when this happens.

Where people get stuck

gh auth login
More people stall here than on the install itself. Run gh auth status first.
The access check comes back mostly empty
Deploy keys and webhooks need admin on the repo. Without it the tool says so plainly. Don't read that as "there are none".
Nothing shows up at all
If the restore is already done, a clean result is expected. Still worth one run per account, since each account sees a different slice.

There is no installer, on purpose

This tool asks for access to your repositories. An unsigned binary asking for exactly that is indistinguishable from the attack it goes looking for.

Whoever runs this just got breached. What you hand someone on that day is source they can read.

Worth knowing up front

It is not a website: It's a window on your machine. No URL to visit, no account to sign up for.
The token is never stored: Borrowed from gh each time, and never handed to the interface.
It never executes anything: Nothing is cloned, installed or built. It only reads.
Three languages: Korean, English, Japanese. Written in each, not translated into it.

Getting your team to run it

Every account sees a different slice. One person's scan is not the whole picture, so it is worth one run each.

Paste this into your team channel

A tool for finding out what changed after repos get hit.
Please run it once from your own account.

https://github.com/gitmoru/gitmoru

You need: Node 22+, pnpm, GitHub CLI

  git clone https://github.com/gitmoru/gitmoru.git
  cd gitmoru
  gh auth login
  pnpm install
  pnpm app

Enter the org name, hit Dig, leave the time window at its default.
Tell us what you got, including if you got nothing.

It never clones or runs any code. It only reads.
The token is borrowed from gh and never stored.

Ask for "nothing showed up" too. If that is indistinguishable from "never ran it", the whole team ends up believing it was checked.

Hook up an agent →