Is My Email Address Public? Probably Yes

Email address exposure is the presence of an address in sources outside the owner's control, including scraped pages, version control history, breach dumps, broker files, and the databases of every service that received the address at signup. A single address reused across services becomes one key that scrapers, breach dumps, and brokers can join on, and any one exposure route is sufficient for the address to circulate. An address printed on a page is harvestable by automated finders, an address in a commit remains in repository history, an address held by a breached service enters dumps that circulate for years, and an address handed to brokers and lists is resold through chains the owner never sees. No single route requires carelessness by the owner, and the combination of routes makes the exposure of a reused address a structural property of the address rather than an accident of one signup. The practical distinction is not whether an address is exposed but whether an exposed address can be withdrawn without affecting the rest of a mailbox.

Scraping mechanisms

A typical finder fetches a page, loads it into a parser such as Cheerio, strips script and style tags, and runs a regular expression over the body text:

const emails = [...new Set(
  (text.match(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g) || [])
)];

A second pass covers mailto: links, which hand over the address in structured form, and some finders add a guessing step in which a name and a domain generate candidate patterns such as first@ and first.last@, with each candidate tested for whether it accepts mail. A predictable address format at a company is a liability on its own, even when no address is published anywhere, because the format itself makes the guessing step productive. The asymmetry between the two sides is stark: the finder requires roughly ten lines of code, while defence requires coverage of every page, every commit, and every signup. Scraping other people's pages carries legal and terms-of-service consequences that vary by place and by site, and those consequences belong to the operator of the finder rather than to the owner of the address.

Version control history

The address in a git configuration becomes the address recorded in every commit made from that machine:

git config --global user.email "[e-mail]"

GitHub Docs states that the address "will be visible in any future commits you push to GitHub from the command line", and the same docs note that "any commits you made prior to changing your commit email address are still associated with your previous email address." Contributor addresses are recoverable from any repository through a git shortlog pipeline that pulls the log and extracts the address pattern, which is git working as designed rather than a vulnerability in git, and a single commit made years ago can still disclose its address today.

GitHub provides a setting under Emails, "Keep my email addresses private", together with a no-reply address for commits and a block on command-line pushes that expose a private email, so that a misconfigured machine fails loudly instead of leaking quietly. With the no-reply address set in the git configuration, new commits carry no personal address, while old commits still carry the old address and nothing short of rewriting history changes that. The version control exposure is therefore self-inflicted and persistent at the same time: the fix covers future commits only, and the history already published remains published.

Exposure checks

Have I Been Pwned reports which known breaches include an address, and that report is the fastest real answer to whether an address is circulating. A search of the owner's inbox for signup confirmations shows how widely the address has been handed out, a search of public repositories for the address in commit logs shows the version control exposure, and a quoted web search for the address shows which pages print it. Each check covers a different route, and no single check covers all four, because breach dumps, broker files, scraped pages, and signup databases are separate sources with separate records. The checks establish exposure, not blame, since no single route has to be the owner's fault for the address to be out.

Alias separation

An address that is already exposed cannot be unpublished, and the available response is to stop giving it out. AliasFleet provides managed, persistent aliases, one address per signup, each forwarding to the real inbox, so that an alias receiving mail it should not receive names its source and can be deactivated on its own while the rest of the mailbox is unaffected. That model is described in how email aliases work, the collection routes are covered in How spammers get your address, and the attribution that follows is covered in how to find out which website leaked your email. Pairing alias separation with the version control fix above divides the two remaining surfaces: the no-reply address covers commits, an alias covers signups, newsletters, and any service that asks for an address before it has earned trust, and the real inbox address remains reserved for the small set of people and services that genuinely need it. An exposed address therefore stops being the key to everything, because each new exposure is confined to one alias that can be withdrawn on its own.