{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:PGIXB4VKM3FAYIZ7XI53C6LKV5","short_pith_number":"pith:PGIXB4VK","canonical_record":{"source":{"id":"1908.05354","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2019-08-14T21:19:24Z","cross_cats_sorted":[],"title_canon_sha256":"d72a71af27b59f907b498ed2fd3180a93fa261b2aa951b50653a8b3b8f532dc3","abstract_canon_sha256":"3782f0c975bf4d8454ce89b75753b333ecee3eb02f6a93a8d9e70399e79743b3"},"schema_version":"1.0"},"canonical_sha256":"799170f2aa66ca0c233fba3bb1796aaf4c4c3fc29e5cd659e68e3ee281285195","source":{"kind":"arxiv","id":"1908.05354","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1908.05354","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"arxiv_version","alias_value":"1908.05354v2","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1908.05354","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"pith_short_12","alias_value":"PGIXB4VKM3FA","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"pith_short_16","alias_value":"PGIXB4VKM3FAYIZ7","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"pith_short_8","alias_value":"PGIXB4VK","created_at":"2026-07-04T23:58:29Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:PGIXB4VKM3FAYIZ7XI53C6LKV5","target":"record","payload":{"canonical_record":{"source":{"id":"1908.05354","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2019-08-14T21:19:24Z","cross_cats_sorted":[],"title_canon_sha256":"d72a71af27b59f907b498ed2fd3180a93fa261b2aa951b50653a8b3b8f532dc3","abstract_canon_sha256":"3782f0c975bf4d8454ce89b75753b333ecee3eb02f6a93a8d9e70399e79743b3"},"schema_version":"1.0"},"canonical_sha256":"799170f2aa66ca0c233fba3bb1796aaf4c4c3fc29e5cd659e68e3ee281285195","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-04T23:58:29.102239Z","signature_b64":"cFawtTlHFxZNw1t84piRHSzIhRqbWeCkzmN4mbdLU/h2zg1mdZ5mTFdoNXembEf3F4noygzb43OCqzAeJkuBAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"799170f2aa66ca0c233fba3bb1796aaf4c4c3fc29e5cd659e68e3ee281285195","last_reissued_at":"2026-07-04T23:58:29.101788Z","signature_status":"signed_v1","first_computed_at":"2026-07-04T23:58:29.101788Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1908.05354","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-04T23:58:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6lxbeUG+tmfkAPspIXf3WXwUUl6mJrGS66g+9EVDMaj6y3pqqOdNlpeeOIo/O5IhrwsQrAEDyxAXvhlpFWsnCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T14:52:10.113654Z"},"content_sha256":"2fa503e96478badeeb35e142ed5a9cad9e93a9619a00f08c2f9e8dded8e17246","schema_version":"1.0","event_id":"sha256:2fa503e96478badeeb35e142ed5a9cad9e93a9619a00f08c2f9e8dded8e17246"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:PGIXB4VKM3FAYIZ7XI53C6LKV5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Large-Scale-Exploit of GitHub Repository Metadata and Preventive Measures","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"David Knothe, Frederick Pietschmann","submitted_at":"2019-08-14T21:19:24Z","abstract_excerpt":"When working with Git, a popular version-control system, email addresses are part of the metadata for each individual commit. When those commits are pushed to remote hosting services like GitHub, those email addresses become visible not only to fellow developers, but also to malicious actors aiming to exploit them.\n  As a part of our research we created a tool that leverages the publicly available GitHub API to collect user data. Analysis of this data not only gives access to millions of email addresses in very little time, but is also powerful and dense enough to create targeted phishing atta"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1908.05354","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1908.05354/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-04T23:58:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xltjRvUi07dewWDUEfnncO0AbsX8IdN1hkm9apH/3rhh2jixxE+kHDTcKzv0E7g1/P1ht0dXTABAAzD6WlzCAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T14:52:10.114169Z"},"content_sha256":"8f8a3e8097aa874f3fd2c2df4706175ca1faea23a5beef84305ebb44ab9d1458","schema_version":"1.0","event_id":"sha256:8f8a3e8097aa874f3fd2c2df4706175ca1faea23a5beef84305ebb44ab9d1458"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PGIXB4VKM3FAYIZ7XI53C6LKV5/bundle.json","state_url":"https://pith.science/pith/PGIXB4VKM3FAYIZ7XI53C6LKV5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PGIXB4VKM3FAYIZ7XI53C6LKV5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-16T14:52:10Z","links":{"resolver":"https://pith.science/pith/PGIXB4VKM3FAYIZ7XI53C6LKV5","bundle":"https://pith.science/pith/PGIXB4VKM3FAYIZ7XI53C6LKV5/bundle.json","state":"https://pith.science/pith/PGIXB4VKM3FAYIZ7XI53C6LKV5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PGIXB4VKM3FAYIZ7XI53C6LKV5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:PGIXB4VKM3FAYIZ7XI53C6LKV5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3782f0c975bf4d8454ce89b75753b333ecee3eb02f6a93a8d9e70399e79743b3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2019-08-14T21:19:24Z","title_canon_sha256":"d72a71af27b59f907b498ed2fd3180a93fa261b2aa951b50653a8b3b8f532dc3"},"schema_version":"1.0","source":{"id":"1908.05354","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1908.05354","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"arxiv_version","alias_value":"1908.05354v2","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1908.05354","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"pith_short_12","alias_value":"PGIXB4VKM3FA","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"pith_short_16","alias_value":"PGIXB4VKM3FAYIZ7","created_at":"2026-07-04T23:58:29Z"},{"alias_kind":"pith_short_8","alias_value":"PGIXB4VK","created_at":"2026-07-04T23:58:29Z"}],"graph_snapshots":[{"event_id":"sha256:8f8a3e8097aa874f3fd2c2df4706175ca1faea23a5beef84305ebb44ab9d1458","target":"graph","created_at":"2026-07-04T23:58:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1908.05354/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"When working with Git, a popular version-control system, email addresses are part of the metadata for each individual commit. When those commits are pushed to remote hosting services like GitHub, those email addresses become visible not only to fellow developers, but also to malicious actors aiming to exploit them.\n  As a part of our research we created a tool that leverages the publicly available GitHub API to collect user data. Analysis of this data not only gives access to millions of email addresses in very little time, but is also powerful and dense enough to create targeted phishing atta","authors_text":"David Knothe, Frederick Pietschmann","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2019-08-14T21:19:24Z","title":"Large-Scale-Exploit of GitHub Repository Metadata and Preventive Measures"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1908.05354","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2fa503e96478badeeb35e142ed5a9cad9e93a9619a00f08c2f9e8dded8e17246","target":"record","created_at":"2026-07-04T23:58:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3782f0c975bf4d8454ce89b75753b333ecee3eb02f6a93a8d9e70399e79743b3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2019-08-14T21:19:24Z","title_canon_sha256":"d72a71af27b59f907b498ed2fd3180a93fa261b2aa951b50653a8b3b8f532dc3"},"schema_version":"1.0","source":{"id":"1908.05354","kind":"arxiv","version":2}},"canonical_sha256":"799170f2aa66ca0c233fba3bb1796aaf4c4c3fc29e5cd659e68e3ee281285195","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"799170f2aa66ca0c233fba3bb1796aaf4c4c3fc29e5cd659e68e3ee281285195","first_computed_at":"2026-07-04T23:58:29.101788Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-04T23:58:29.101788Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"cFawtTlHFxZNw1t84piRHSzIhRqbWeCkzmN4mbdLU/h2zg1mdZ5mTFdoNXembEf3F4noygzb43OCqzAeJkuBAw==","signature_status":"signed_v1","signed_at":"2026-07-04T23:58:29.102239Z","signed_message":"canonical_sha256_bytes"},"source_id":"1908.05354","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2fa503e96478badeeb35e142ed5a9cad9e93a9619a00f08c2f9e8dded8e17246","sha256:8f8a3e8097aa874f3fd2c2df4706175ca1faea23a5beef84305ebb44ab9d1458"],"state_sha256":"f28b9736a9ab34d4efbe4a1e00b49e3d6aca30912405fff7a988be8704bfbe7b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"IT6800Fv0d+PbyA8ZhxNpC0wB1P0gTZSU8s+FPIMUNfLctkuGW5SZIAOXJPUMxcnEcplT25ISx3kErWCrlt+Aw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-16T14:52:10.118334Z","bundle_sha256":"10eb904c20858361039f58938b9055032fa0def2f99eb431c8dd0cfc2a182d2c"}}