When developers focus on Git privacy, they usually think about stripping author names and emails from commit histories. However, there is a massive privacy leak hiding in plain sight: binary files.
If your repository or Pull Request includes screenshots, diagrams, architectural PDFs, or sample images, those files may contain embedded EXIF and document metadata. This hidden data can expose your exact GPS coordinates, camera/device models, username paths, creation timestamps, and software versions—regardless of how clean your Git commit log is.
In this practical tutorial, we will cover how to audit and strip binary metadata using exiftool, and how to pair it with gitGost for end-to-end contribution anonymity.
1. The Invisible Risk: What Binary Files Leak
Standard Git commit anonymization strips user.name, user.email, and commit timestamps. But Git treats binary files as opaque blobs, leaving internal file metadata untouched.
Common files that leak personal metadata include:
- Images (
.png,.jpg,.webp): EXIF tags containing GPS location, device serial numbers, software build info, and original creation dates. - PDF Documents: Embedded author names, local file directory paths (e.g.,
/Users/yourname/Documents/...), and editing history. - Office Documents (
.docx,.xlsx): Company names, author profiles, and revision trackings.
If you upload a screenshot of a bug fix, an attacker or automated scraper can extract your location or local system username directly from the file.
2. Auditing and Cleaning Metadata with exiftool
The industry standard for inspecting and stripping file metadata is exiftool.
Step 1: Install exiftool
- macOS:
brew install exiftool - Linux (Ubuntu/Debian):
sudo apt install libimage-exiftool-perl - Windows: Download the executable from the official site or install via
choco install exiftool.
Step 2: Inspect Hidden Metadata
Before modifying a file, check what metadata it currently exposes:
exiftool screenshot.png
Look closely at fields like Camera Model, GPS Position, Create Date, and Software.
Step 3: Strip All Metadata
To wipe all internal tags cleanly, run:
exiftool -all= -overwrite_original screenshot.png
Note: The -overwrite_original flag prevents exiftool from creating backup files (_original), ensuring no uncleaned copies remain in your working directory.
To process an entire folder of assets before committing:
exiftool -all= -overwrite_original -ext png -ext jpg -ext pdf ./docs/images/
3. End-to-End Privacy: Pairing exiftool with gitGost
Wiping file metadata is only half the battle. If you attach cleaned images to a commit and push from your personal account, your Git author details and IP address will still be exposed.
To achieve strong anonymity across both files and Git logs, use gitGost.
What is gitGost?
gitGost is an open-source, AGPL-3.0 proxy written in Go that allows you to push code and create Pull Requests without exposing accounts, tokens, or commit metadata. PRs are automatically created on your behalf by the neutral @gitgost-anonymous bot.
Complete Anonymous Contribution Workflow
-
Clean your assets:
exiftool -all= -overwrite_original diagram.png -
Commit your changes locally:
git add diagram.png git commit -m "docs: add updated architecture diagram"(Pro tip: Write a detailed commit message, as gitGost uses your commit message as the PR description.)
-
Add the gitGost remote:
git remote add gost https://gitgost.fly.dev/owner/repository(gitGost supports public repositories on both GitHub and GitLab.)
-
Push anonymously:
git push gost main -
Optional (IP Masking via Tor):
While gitGost removes author name, email, and timestamps, the proxy server can still see your IP address. To mask your IP, wrap your push withtorsocks:
torsocks git push gost main
4. Threat Model & Boundaries
Understanding the boundaries of your toolchain is essential for privacy:
- What gitGost +
exiftoolprotects against: Public exposure of author name/email, binary EXIF/GPS leaks, account-to-PR association, and passive metadata scraping by recruiters or bots. - Operational limits: gitGost enforces repository size caps 500 MB, commit limits 10 MB, and rate limits 5 PRs/IP/hour to prevent abuse.
- What it does NOT protect against: Code style analysis (stylometry) or targeted surveillance by nation-state actors.
Conclusion: Clean Code, Clean Files
Privacy in open source requires a layered approach. By stripping binary EXIF metadata with exiftool and pushing through gitGost, you ensure that neither your assets nor your Git logs become permanent liabilities.
Frequently Asked Questions (FAQ)
Can I contribute to GitHub anonymously?
Yes. Tools such as gitGost allow developers to create anonymous Pull Requests without exposing their GitHub account, name, or email address.
Does GitHub strip EXIF data from uploaded images?
No. GitHub preserves the raw binary content of committed files, meaning any embedded EXIF or GPS data remains publicly readable in the repository history.
Is anonymous open-source contribution legitimate?
Yes. Many developers use anonymity to avoid employer conflicts, political risks, harassment, or unwanted profiling by recruiters.
If you care about developer privacy, consider starring the gitGost repository on GitHub!
Top comments (3)
The part people miss is that a clean git log means nothing if the PR carries a screenshot with /Users/yourname baked into the PDF. We got burned by bug-report images leaking local paths, so we moved the exiftool strip into a CI step rather than trusting a manual pre-commit audit.
For repos using git-lfs, did you weigh running the strip as a clean/smudge filter so the committed blob is already scrubbed, versus auditing after the fact?
Wow! That’s a really good point and an excellent suggestion; I had never even considered—or thought about—it, lol. But it’s a great idea for a future CI setup. If you're okay with it, I'll create an issue in the gitGost repository to suggest this; we could even create a public Action that’s easy to install for any repo. 👏
Some comments may only be visible to logged-in visitors. Sign in to view all comments.