git log --diff-filter=D --summary | grep delete

This command lists every file that’s been deleted in the repo’s history. These are your candidates.

3. Inspect the History of a File

git log --oneline --all -- <path>

This shows the commit hashes and messages related to that file. You’ll see who deleted it, when, and why.

4. Look at Commit Context

git log --diff-filter=D --stat -- <path>

Now you’re checking the bigger picture: what else changed in that commit? Was it a rushed “fix typo” commit that also deleted a config? That’s suspicious.

5. Restore the File

git checkout <commit-hash>^ -- <path>

This brings back the deleted file locally. Remember — never push this upstream. You’re only restoring it for analysis.

6. Peek Inside

grep -nE "AKIA|-----BEGIN PRIVATE KEY-----|password|secret|token" <path> || true

This lets you preview the file for patterns like AWS keys, private keys, or hardcoded credentials.

7. Cross-Check for Context

git grep -n "partial_key_prefix_or_domain" || true

Search the repo for references. Maybe that AWS key is tied into a CI script, or the cert connects to staging servers. This boosts the severity of your finding.

Scale and Automation

Doing this manually across hundreds of repos takes time. You could be digging through commits all week.

That’s why I scripted it. Just a simple Bash loop that runs in the background on a VPS and alerts me via Discord when it finds matches.

The point isn’t the script — it’s the idea. If you can script, automate it. If not, learn how. Either way, the technique stays the same.

Quick Recap

• Deleted doesn’t mean gone — Git keeps history.
• You can restore deleted files and analyze them.
• Secrets often hide in configs, certs, or keys devs thought they removed.
• With proper triage, these findings can lead to high-severity bounties.

That’s why TrashCash matters. What looks like garbage can be your biggest report.

Final Words

Hunting isn’t always about flashy payloads or new zero-days. Sometimes, it’s about thinking differently, looking where others don’t, and using the tools we already have in smarter ways.

TrashCash is one of those methods — simple, overlooked, and extremely powerful when applied right.

So next time you’re in a repo, don’t just look at the code that’s there. Look at the ghosts of the files that came before.

Because in Git… the trash never really leaves.