DEV Community: livrasand

Wiping EXIF Metadata Before Publishing Open Source Projects

livrasand — Fri, 11 Sep 2026 16:21:58 +0000

When developers focus on Git privacy, they usually think about stripping author names and emails from commit histories. However, there is a massive privacy leak hiding in plain sight: binary files.

If your repository or Pull Request includes screenshots, diagrams, architectural PDFs, or sample images, those files may contain embedded EXIF and document metadata. This hidden data can expose your exact GPS coordinates, camera/device models, username paths, creation timestamps, and software versions—regardless of how clean your Git commit log is.

In this practical tutorial, we will cover how to audit and strip binary metadata using exiftool, and how to pair it with gitGost for end-to-end contribution anonymity.

1. The Invisible Risk: What Binary Files Leak

Standard Git commit anonymization strips user.name, user.email, and commit timestamps. But Git treats binary files as opaque blobs, leaving internal file metadata untouched.

Common files that leak personal metadata include:

Images (.png, .jpg, .webp): EXIF tags containing GPS location, device serial numbers, software build info, and original creation dates.
PDF Documents: Embedded author names, local file directory paths (e.g., /Users/yourname/Documents/...), and editing history.
Office Documents (.docx, .xlsx): Company names, author profiles, and revision trackings.

If you upload a screenshot of a bug fix, an attacker or automated scraper can extract your location or local system username directly from the file.

2. Auditing and Cleaning Metadata with `exiftool`

The industry standard for inspecting and stripping file metadata is exiftool.

Step 1: Install `exiftool`

macOS: brew install exiftool
Linux (Ubuntu/Debian): sudo apt install libimage-exiftool-perl
Windows: Download the executable from the official site or install via choco install exiftool.

Step 2: Inspect Hidden Metadata

Before modifying a file, check what metadata it currently exposes:

exiftool screenshot.png

Look closely at fields like Camera Model, GPS Position, Create Date, and Software.

Step 3: Strip All Metadata

To wipe all internal tags cleanly, run:

exiftool -all= -overwrite_original screenshot.png

Note: The -overwrite_original flag prevents exiftool from creating backup files (_original), ensuring no uncleaned copies remain in your working directory.

To process an entire folder of assets before committing:

exiftool -all= -overwrite_original -ext png -ext jpg -ext pdf ./docs/images/

3. End-to-End Privacy: Pairing `exiftool` with gitGost

Wiping file metadata is only half the battle. If you attach cleaned images to a commit and push from your personal account, your Git author details and IP address will still be exposed.

To achieve strong anonymity across both files and Git logs, use gitGost.

What is gitGost?

gitGost is an open-source, AGPL-3.0 proxy written in Go that allows you to push code and create Pull Requests without exposing accounts, tokens, or commit metadata. PRs are automatically created on your behalf by the neutral @gitgost-anonymous bot.

Complete Anonymous Contribution Workflow

Clean your assets:

exiftool -all= -overwrite_original diagram.png

Commit your changes locally:
```
git add diagram.png
git commit -m "docs: add updated architecture diagram"
```
(Pro tip: Write a detailed commit message, as gitGost uses your commit message as the PR description.)
Add the gitGost remote:
```
git remote add gost https://gitgost.fly.dev/owner/repository
```
(gitGost supports public repositories on both GitHub and GitLab.)
Push anonymously:
```
git push gost main
```
Optional (IP Masking via Tor):
While gitGost removes author name, email, and timestamps, the proxy server can still see your IP address. To mask your IP, wrap your push with torsocks:
```
torsocks git push gost main
```

4. Threat Model & Boundaries

Understanding the boundaries of your toolchain is essential for privacy:

What gitGost + exiftool protects against: Public exposure of author name/email, binary EXIF/GPS leaks, account-to-PR association, and passive metadata scraping by recruiters or bots.
Operational limits: gitGost enforces repository size caps 500 MB, commit limits 10 MB, and rate limits 5 PRs/IP/hour to prevent abuse.
What it does NOT protect against: Code style analysis (stylometry) or targeted surveillance by nation-state actors.

Conclusion: Clean Code, Clean Files

Privacy in open source requires a layered approach. By stripping binary EXIF metadata with exiftool and pushing through gitGost, you ensure that neither your assets nor your Git logs become permanent liabilities.

Frequently Asked Questions (FAQ)

Can I contribute to GitHub anonymously?
Yes. Tools such as gitGost allow developers to create anonymous Pull Requests without exposing their GitHub account, name, or email address.

Does GitHub strip EXIF data from uploaded images?
No. GitHub preserves the raw binary content of committed files, meaning any embedded EXIF or GPS data remains publicly readable in the repository history.

Is anonymous open-source contribution legitimate?
Yes. Many developers use anonymity to avoid employer conflicts, political risks, harassment, or unwanted profiling by recruiters.

If you care about developer privacy, consider starring the gitGost repository on GitHub!

Your Git Commit History Is More Public Than You Think 🕵️‍♂️

livrasand — Wed, 01 Jul 2026 15:52:13 +0000

In the open source world, we often say that "your code is your resume." However, what many developers forget is that every time they run a git push, they're handing over much more than just lines of code. They're delivering a permanent digital trail that can be tracked, analyzed, and used against them years later.

This article is an educational guide about privacy in Git and how the metadata you generate every second can compromise your security and your professional future.

The command that reveals your "naked identity"

If you want to see exactly what you're sharing with the world, open your terminal in any repository and run the following command:

git log --format=fuller

Unlike the standard log, the fuller format breaks down the complete anatomy of your contributions. This is where most developers are shocked to see what they're actually leaking:

1. Name and Email (Direct Exposure)

Git stores your user.name and user.email locally in every commit. This data:

Is harvested by spam bots for marketing databases.
Allows recruiters to map all your historical activity, even on projects you no longer represent.
Exposes you to doxxing attacks if you contribute to controversial projects.

2. Dates and Timestamps (Time Analysis)

Git not only saves the day, but also the exact second and time zone of the authorship and commit. This allows you to create an activity pattern:

What time do you usually code?
Are you working on personal projects during office hours?
What geographical area are you actually in?

3. File Patterns and Metadata

In addition to text, if you upload binaries (PDFs or images), these usually contain EXIF metadata (GPS coordinates, camera model, etc.) that Git doesn't clean up by default.

The Problem with "Permanent Logs"

GitHub is, by design, an accountability platform, not a privacy one. Once a commit enters the public history, deleting it is extremely difficult and often pointless if the repository has already been cloned or indexed by third-party services.

This creates a HR liability risk: a contribution made today could be judged in a completely different context five years from now.

The Solution: Enter GitGost 👻

For those times when you want your code to speak for itself, without any identifying tags, there's GitGost.

GitGost is an open-source proxy designed to offer strong anonymity for your contributions. It requires no accounts, tokens, or complex browser configurations.

How Does It Work?

Instead of uploading code directly to GitHub with your identity, you submit it through GitGost. The server:

Clean all your metadata (name, email, timestamps).
Replace the authorship with the neutral bot @gitgost-anonymous.
Automatically create a Pull Request in the target repository.

Quick Workflow:

1. Add the GitGost remote

git remote add gost https://gitgost.fly.dev/owner/repo

2. Push your branch (without logs or tokens)

git push gost main

Is this just for "hackers"?

Absolutely not. Anonymity in open source has legitimate and ethical use cases:

Employees who want to fix bugs in competing tools without violating exclusivity clauses.
Activists and journalists in censored regions who need to contribute to privacy tools without personal risk.
Developers who simply want to fix an annoying typo without it defining their public profile forever.

Conclusion: Be a ghost, fix the internet

Privacy isn't about hiding something bad; it's about having the power to choose what you share. If you believe developers deserve the right to contribute without being permanently profiled, it's time to start auditing your metadata.

Frequently Asked Questions (FAQ)

Can I contribute to GitHub anonymously?
Yes. Tools like gitGost allow you to create anonymous pull requests without exposing your GitHub account, name, or email address.

Does GitHub expose my email address?
Potentially, yes. Git commits contain author metadata (email) unless they are specifically anonymized before being published.

Is anonymous open source contribution legitimate?
Yes. Many developers use anonymity to avoid harassment, workplace conflicts, political risks, or unwanted profiling by recruiters.

If you're passionate about privacy, check out the gitGost repository and leave a star to support the right to anonymity in development.

How to Contribute to GitHub Anonymously in 2026

livrasand — Mon, 29 Jun 2026 17:23:00 +0000

In the world of open source, your code is your resume. But sometimes, you want the code to speak for itself without attaching your legal name, your company’s email, or a permanent timestamp to it. Whether it's to avoid HR liabilities, contribute to controversial projects, or simply stay private, contributing anonymously to GitHub is a skill every modern developer should have.

In this guide, we’ll explore why your current Git workflow is "leaking" data and how tools like gitGost are changing the game for privacy in 2026.

Why GitHub Contributions are Permanent

GitHub is designed for accountability, not anonymity. By default, every time you push code, you are creating a permanent public record. This "contribution graph" can become a liability over time:

HR and Recruiters: Your activity can be used to judge your "productivity" or interests during hiring processes.
Email Harvesting: Spammers and scrapers crawl commit histories to build databases of active developer emails.
Political Risks: In some jurisdictions, contributing to specific tools or repositories can lead to real-world consequences.

What Information Your Git Commits Actually Expose

If you run git log --format=fuller on any of your repositories, you’ll see the "naked" truth. A standard Git commit exposes:

Full Name and Email: Your local user.name and user.email settings.
Timestamps: When exactly you authored the code (often revealing your timezone and work habits).
Metadata: Hidden info in binary files (like images or PDFs) through EXIF data.
Identity Correlation: Passive metadata that links your personal GitHub account to every Pull Request you open.

Anonymous Accounts vs. True Anonymity

Many developers think creating a "burner" GitHub account is enough. It's not.
Secondary accounts still carry metadata in the commits. Furthermore, GitHub’s own platform telemetry can often link your accounts via IP addresses or browser fingerprints. True anonymity requires stripping all identifying metadata before the code even reaches a remote server.

The Solution: Using gitGost

gitGost is an open-source proxy designed for "strong anonymity" in Git contributions. It allows you to contribute to any public repository without an account, a token, or metadata.

How to use gitGost (The One-Command Setup)

The beauty of gitGost is that it requires no browser extensions or complex setups. Just add a remote and push:

Add the Gost remote:

git remote add gost https://gitgost.fly.dev/owner/repo

Push your changes:
```
git push gost your-branch
```

What happens next?
gitGost's neutral bot, @gitgost-anonymous, creates a Pull Request on your behalf. Your name, email, and timestamps are stripped and replaced with generic metadata. Your commit message automatically becomes the PR description, so make sure to provide context there.

Enhanced Privacy: Using Tor and Stripping Metadata

For developers who need a higher level of protection (protecting against IP identification), combining gitGost with Tor is the gold standard.

1. Hiding your IP with `torsocks`

gitGost strips your commit data, but the server still sees your IP. To mask it, use torsocks:

# Install on Linux
sudo apt install torsocks
# Push through Tor
torsocks git push gost main

Note: Tor is slower due to its three-layer encryption, so expect the push to take a few minutes.

2. Stripping Binary Metadata with `exiftool`

If your contribution includes images or PDFs, they might contain GPS coordinates or device info. Use exiftool before committing:

exiftool -all= -overwrite_original image.png

The gitGost Threat Model

Anonymity is never absolute. It’s important to understand what gitGost protects you against and what it doesn't:

It protects against: Public exposure of name/email, direct association with your personal account, and passive metadata collection by recruiters or scrapers.
It does NOT protect against: Stylometry (code style analysis), advanced temporal correlation, or nation-states with infrastructure-level access.

Explicit Assumption: You must use a trustworthy network (VPN/Tor) and avoid mixing anonymous and personal contributions in the same repository to stay safe.

Conclusion: Be a Ghost, Fix the Internet

Privacy is a right, even for developers. gitGost was built for responsible, good-faith contributions where identity is unnecessary. It's about giving you the choice to "disappear" after you've made the internet a little better.

Frequently Asked Questions (FAQ)

Can I contribute to GitHub anonymously?
Yes. Tools like gitGost allow you to create anonymous pull requests without exposing your account or metadata.

Does GitHub expose my email address?
Yes, unless you specifically use a proxy or anonymize your Git metadata.

Is anonymous contribution legitimate?
Absolutely. It is used by activists, journalists, and developers wanting to avoid profiling or employer conflicts.

If you believe developers deserve the right to privacy, consider starring the gitGost repository.

DEV Community: livrasand

Wiping EXIF Metadata Before Publishing Open Source Projects

1. The Invisible Risk: What Binary Files Leak

2. Auditing and Cleaning Metadata with exiftool

Step 1: Install exiftool

Step 2: Inspect Hidden Metadata

Step 3: Strip All Metadata

3. End-to-End Privacy: Pairing exiftool with gitGost

What is gitGost?

Complete Anonymous Contribution Workflow

4. Threat Model & Boundaries

Conclusion: Clean Code, Clean Files

Frequently Asked Questions (FAQ)

Your Git Commit History Is More Public Than You Think 🕵️‍♂️

The command that reveals your "naked identity"

1. Name and Email (Direct Exposure)

2. Dates and Timestamps (Time Analysis)

3. File Patterns and Metadata

The Problem with "Permanent Logs"

The Solution: Enter GitGost 👻

How Does It Work?

Quick Workflow:

1. Add the GitGost remote

2. Push your branch (without logs or tokens)

Is this just for "hackers"?

Conclusion: Be a ghost, fix the internet

Frequently Asked Questions (FAQ)

How to Contribute to GitHub Anonymously in 2026

Why GitHub Contributions are Permanent

What Information Your Git Commits Actually Expose

Anonymous Accounts vs. True Anonymity

The Solution: Using gitGost

How to use gitGost (The One-Command Setup)

Enhanced Privacy: Using Tor and Stripping Metadata

1. Hiding your IP with torsocks

2. Stripping Binary Metadata with exiftool

The gitGost Threat Model

Conclusion: Be a Ghost, Fix the Internet

Frequently Asked Questions (FAQ)

2. Auditing and Cleaning Metadata with `exiftool`

Step 1: Install `exiftool`

3. End-to-End Privacy: Pairing `exiftool` with gitGost

1. Hiding your IP with `torsocks`

2. Stripping Binary Metadata with `exiftool`