Step 1: Tech fingerprint → determine search keywords
├── Frontend: Vue/React specific code snippets
├── Backend: /actuator, /api/xxx patterns
├── Page title/copyright/error message characteristic strings
└── Cookie names/Session ID format
 
Step 2: GitHub/Gitee search
├── site:github.com "unique string" (Google dork)
├── github_search_code with unique code snippets
├── gitee_search_open_source_repositories with product name
└── Priority: config files > source code > documentation
 
Step 3: Secondary confirmation
├── Compare directory structure
├── Compare API routes
├── Compare frontend JS variable names/comments
└── Save links after confirmation — do NOT download

# From tech fingerprint → search queries:
1. Unique error messages:
   "com.example.controller" "Internal Server Error"
 
2. Cookie/Header patterns:
   "JSESSIONID" "companyname"
 
3. Frontend code snippets:
   "apiBaseUrl" "https://target.com"
 
4. Page titles:
   "XX管理系统" in:readme
 
5. File patterns:
   "application.yml" "spring.datasource.url"
   ".env" "DB_PASSWORD"
 
6. Framework config paths:
   path:pom.xml "groupId" "artifact"
   path:composer.json "name"

□ Config files: application.yml, .env, settings.py, config.js
□ Database config: JDBC URL, DB credentials, connection strings
□ API keys: cloud service keys, third-party API keys
□ Internal docs: README with architecture, deployment guide
□ Test code: test data with real credentials
□ CI/CD config: .gitlab-ci.yml, Jenkinsfile, GitHub Actions
□ Docker config: Dockerfile, docker-compose.yml, environment vars

github_search_code: unique code snippet from target's JS
github_search_repositories: product/company name
gitee_search_open_source_repositories: product name
 
Google dork:
site:github.com "target-unique-string"
site:gitee.com "target-unique-identifier"
 
GitDorker / truffleHog: for credential leaks
Focus: .env, config files, docker-compose.yml, credentials.json