Find ghost accounts in your GitHub organization
Ghostbuster is a free script that shows who can reach your code, who hasn't used their access in months, and who left the company but never left GitHub. It runs on your own computer and changes nothing.
Version 0.1.0 · Python 3.8+ · Windows, macOS and Linux · MIT license
What it checks
Ghostbuster reads your organization through GitHub’s API and answers four questions.
Who has access to what
Members, owners, outside collaborators, teams, and the permission each person has on each repository, including where that access comes from.
Who is actually active
Pushes, merges, pull requests, reviews and comments over the last 90 days. Anyone with no activity is double-checked with GitHub search before they are flagged.
Who has left the company
Link GitHub accounts to your employees with a simple CSV file, or automatically through SAML single sign-on, and see who kept their access after they left.
Access nobody uses
Write and admin rights people don’t use, outside collaborators, missing two-factor authentication, old deploy keys and apps that can change every repository.
What you get
When the scan finishes, the report opens in your browser.
- A summary with recommended actions, most urgent first
- Possible ghosts, outside collaborators and unused write access, person by person
- Save as PDF to share it with your team or management
- Spreadsheets, plus ready-made commands to fix each finding. They are all commented out until you have reviewed them
What you need
Ghostbuster runs on your own computer, with your own GitHub login.
A computer with Python 3.8 or newer
Windows, macOS or Linux. Macs and most Linux machines already have Python. On Windows, run winget install Python.Python.3.12 or get it from python.org.
The GitHub CLI (gh)
Ghostbuster signs in through gh. If it isn’t installed, the script offers to install it (winget on Windows, Homebrew on Mac) and walks you through the sign-in. On Linux, install it from cli.github.com.
An owner of the GitHub organization
Members can run it too, but only owners can see two-factor status, invitations, outside collaborators and installed apps.
A few minutes
Small organizations take seconds. Organizations with hundreds of repositories take a few minutes, because GitHub limits how fast its API can be read.
The GitHub permissions it uses
| repo | Private repositories, their collaborators, deploy keys and activity |
| read:org | Members, owners, teams, outside collaborators, invitations and installed apps |
| read:audit_log | Only with --audit-log on Enterprise Cloud: git clone and fetch events |
gh asks for repo and read:org by default. Ghostbuster only reads with them; it never changes anything.
How to run it
- 1
Download and run the script
Open a terminal (PowerShell on Windows, Terminal on Mac) and run:
curl -fsSLO https://adcyma.com/tools/ghostbuster.py python3 ghostbuster.pyDownload the file and run it, rather than piping it straight into Python. The script asks a few questions along the way, and a pipe can’t answer them.
- 2
Sign in to GitHub
Ghostbuster signs you in through the GitHub CLI (gh). If it isn’t installed, the script offers to install it and walks you through the sign-in. Run it as an owner of the organization to get the full picture.
- 3
Read the report
The report opens in your browser when the scan is done. Use Save as PDF to keep a copy.
- 4
Optional: find people who have left
Fill in employee_email and employment_status (active or left) in people.csv, then run again with --mapping people.csv.
Useful options
| --org my-org | The organization to scan. Without it, Ghostbuster asks if you belong to several. |
| --days 180 | Change the activity window. The default is 90 days. |
| --mapping people.csv | Check accounts against a list from HR: columns github_login, employee_email and employment_status. |
| --audit-log | On Enterprise Cloud, also read the audit log, including git clone and fetch events. |
| --account my-login | Pick which gh account to use if you are signed in to several. |
| --max-repos 20 | Try it quickly on the 20 most recently pushed repositories. |
Check the download
SHA-256 checksum of the current version:
3fffc2072c504a8b97a76cef6ee673654b06c0dbe1f92de86f19961a2cf221aeCompare it with shasum -a 256 ghostbuster.py on macOS and Linux, or Get-FileHash ghostbuster.py on Windows.
Private by design
Read-only
It never changes anything in GitHub. Fixes are written as commands for you to review and run yourself.
Nothing leaves your computer
It talks to GitHub’s API and saves the report in a folder on your machine. Nothing is sent to Adcyma.
Source you can read
One Python file with no extra packages. Open it in any editor and read what it does before you run it.
View the sourceFree to use and change
Ghostbuster was created by Jens Naterman at Adcyma and is shared under the MIT license. Use it, copy it, change it and share it, also inside your company or in commercial work. The one condition: keep the copyright notice that credits the original author. The full license is at the top of the script.
Read the MIT licenseCommon questions
No. It only reads. Suggested fixes are written to a file as commented-out commands, so nothing happens until you have reviewed them and run them yourself.
No. The script talks to GitHub’s API with your own GitHub CLI login and saves the results on your computer. Adcyma never sees them.
All of them: Free, Team and Enterprise Cloud. Enterprise Cloud gives the most detail, such as linked single sign-on identities and, with the --audit-log option, events for when someone clones or fetches code.
Yes. On the Free and Team plans GitHub doesn’t show when someone clones or browses code, so the report lists these people as possible ghosts, not confirmed ones. Check with them or their manager before you remove access.
GitHub doesn’t know who your employees are. Fill in the work email and status for each person in people.csv, then run Ghostbuster again with --mapping people.csv. On Enterprise Cloud with SAML single sign-on, accounts are linked automatically.
Yes. It is MIT licensed, so you can change it, run it in your company or build on it. Keep the copyright notice that credits Jens Naterman at Adcyma.
Want to automate this, and more?
Ghostbuster is a one-off check. Adcyma handles onboarding, offboarding and access reviews for Microsoft Entra ID and Active Directory every day, and we are bringing GitHub into it.