We Started Scanning Public EU GitHub Repositories. Here’s How.
A few days ago, we asked ourselves a simple question:
Could we turn public EU GitHub discovery into a repeatable security outreach workflow?
Not as a spam project.
Not as a vanity dashboard.
As a practical challenge: discover public organizations, scan their public repositories, and send each team a useful, curated list of vulnerabilities plus clear fix directions.
That is exactly what this new pipeline is for.
The idea in one line
We are running a continuous discovery + scanning loop for public EU GitHub organizations, then using Verimu to generate actionable findings we can share with those orgs.
Why this is a marketing challenge (and not just a crawler)
Most security messaging is generic.
We wanted to do the opposite:
- start with real public code,
- run real scans,
- send real, practical remediation guidance.
If the report is useful, the intro message earns attention on its own.
How we built it
We added a dedicated EU discovery worker in the backend with two jobs running continuously:
- Discovery job
Searches GitHub organizations by EU location terms and stores newly discovered orgs in a queue table. - Scanner job
Claims organizations in small batches and scans each org profile with Verimu against public repos.
The scanner currently runs with conservative defaults so we can scale safely:
- max org cap:
50,000 - max repos per org scan:
10 - scan concurrency:
2 - rescan window:
30days
This gives us steady throughput without hammering APIs or creating noisy output.
The workflow, step by step
1) Discover organizations
We query GitHub Search for organization accounts tied to EU countries and normalize them into a single queue.
Each discovered org is stored with scan status (pending, scanning, done, failed) so work is resumable and trackable.
2) Claim work safely
The scanner claims rows with DB locking (FOR UPDATE SKIP LOCKED) so parallel workers do not process the same org twice.
That matters once this runs continuously in production.
3) Scan public repos
For each claimed org, we run a profile scan through Verimu and limit scope per run to keep cycles predictable.
At a high level, it looks like:
verimu github --profile <org-name> --max-repos 10
4) Track outcomes and retry
Successes are marked done.
Failures are marked failed with retry counters and error context.
That means we can recover from API hiccups or transient errors without manual babysitting.
What we plan to send each organization
The outreach package is simple:
- the highest-priority vulnerabilities found in public repos,
- why each issue matters in practice,
- concrete fix guidance (upgrade targets, dependency actions, and priority order).
The goal is signal over noise.
A small list of fixable, high-value actions beats a giant unfiltered report.
Important guardrails
This challenge only targets public repositories and public organization metadata.
No private code. No invasive behavior.
Operationally, we also added:
- API pacing to stay within GitHub limits,
- configurable caps for scan scope,
- periodic rediscovery and rescanning to keep data fresh.
Why we think this matters
There are thousands of EU engineering teams with exposed risk in plain sight, but most never receive specific, useful guidance.
If we can close that gap with high-quality, curated findings, this becomes more than a marketing experiment. It becomes a repeatable way to help teams ship safer software faster.
We will keep refining the pipeline as coverage grows.
If you want us to run this workflow for your organization directly, get started free → or book a demo.