Github search is quite powerful and useful feature and can be used to search sensitive data on the repositories. Collection of github dorks that can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is supposed to be useful for assessing security and performing pen-testing of systems.
Please consider contributing the dorks that can reveal potentially senstive information in github.
List of dorks follow. I am not categorizing at the moment. Instead am going to just the list of dorks with optionally a description separated by # in the same line. Many of the dorks can be modified to make the search more specific or generic. You can see more options HERE.
filename:.npmrc _auth # npm registry authentication data
filename:.dockercfg auth # docker registry authentication data
extension:pem private # private keys
extension:ppk private # puttygen private keys
filename:id_rsa or filename:id_dsa # private ssh keys
extension:sql mysql dump # mysql dump
extension:sql mysql dump password # mysql dump look for password; you can try varieties
filename:credentials aws_access_key_id # might return false negatives with dummy values
filename:.s3cfg # might return false negatives with dummy values
filename:wp-config.php # wordpress config files
filename:.htpasswd # htpasswd files
filename:.env DB_USERNAME NOT homestead # laravel .env (CI, various ruby based frameworks too)
filename:.env MAIL_HOST=smtp.gmail.com # gmail smtp configuration (try different smtp services too)
filename:.git-credentials # git credentials store, add NOT username for more valid results
PT_TOKEN language:bash # pivotaltracker tokens
filename:.bashrc password # search for passwords, etc. in .bashrc (try with .bash_profile too)
filename:.bashrc mailchimp # variation of above (try more variations)
filename:.bash_profile aws # aws access and secret keys
rds.amazonaws.com password # Amazon RDS possible credentials
extension:json api.forecast.io # try variations, find api keys/secrets
extension:json mongolab.com # mongolab credentials in json configs
extension:yaml mongolab.com # mongolab credentials in yaml configs (try with yml)
jsforce extension:js conn.login # possible salesforce credentials in nodejs projects
SF_USERNAME "salesforce" # possible salesforce credentials
filename:.tugboat NOT "_tugboat" # Digital Ocean tugboat config