Share a private GitHub repo with anyone, no collaborator invite, no paid seat, no cleanup.

Adding a contractor or auditor as a GitHub collaborator means IT tickets, legal paperwork, a paid seat, and a permission that lingers long after the review is done. Most teams end up emailing zip files or screensharing instead, both worse.

gh-relay fixes this in one command. Run it on your machine, share a temporary URL, and your guest gets a read-only browser view of the codebase. When you press Ctrl+C, the link is dead, zero cleanup, zero lingering access.

$ export GH_RELAY_TOKEN=ghp_...
$ gh-relay share --repo my-org/private-app --expire 1h

   Token valid
   Repository: my-org/private-app (private)
   Found 12 branch(es)
   Tunnel active

    Share this URL with your guest:
    https://shiny-apple-92.trycloudflare.com

    Session expires in: 1h
  Press Ctrl+C to end the session immediately.

                          YOUR MACHINE
┌───────────────────────────────────────────────────────────────────────────┐
│                                                                           │
│  GH_RELAY_TOKEN  ──►  ┌─────────────────┐       ┌──────────────────────┐  │
│  (or --token)         │   gh-relay      │       │   Tunnel Provider    │  │
│  never leaves         │   proxy         │ ────► │                      │  │
│                        └─────────────────┘      │  • Cloudflare (free) │  │
│                              │                  │  • ngrok (free tier) │  │
│                        ┌─────▼─────┐            └──────────┬───────────┘  │
│                        │ optional  │                       │              │
│                        │ passcode  │                       │              │
│                        │ protection │                      │              │
│                        └───────────┘                       │              │
└────────────────────────────────────────────────────────────│──────────────┘
                                                             │
                                                             │ temp URL
                                                             ▼
┌────────────────────────────────────────────────────────────────────────────┐
│                              GUEST                                         │
│                                                                            │
│   Browser ──► (URL + optional passcode) ──► read-only file browser         │
│                                                                            │
│   No GitHub account needed. Cannot push, clone, or download files.         │
│                                                                            │
└────────────────────────────────────────────────────────────────────────────┘

1. You run gh-relay share with your GitHub token and repo name.
2. A local proxy starts on your machine and fetches files from GitHub using your token.
3. A secure tunnel (Cloudflare or ngrok) exposes the proxy via a temporary public URL.
4. Your guest opens the URL and gets a read-only file browser. Optionally protect with a passcode.
5. You press Ctrl+C (or --expire elapses) and the tunnel closes instantly. The URL is dead. Your PAT never leaves your machine. The guest can't push, clone, or access anything you didn't share.

brew install soub4i/tap/gh-relay

Grab the latest release for your platform from the Releases page.

# macOS (Apple Silicon)
curl -L https://github.com/soub4i/gh-relay/releases/latest/download/gh-relay_darwin_arm64.tar.gz | tar xz
sudo mv gh-relay /usr/local/bin/

# macOS (Intel)
curl -L https://github.com/soub4i/gh-relay/releases/latest/download/gh-relay_darwin_amd64.tar.gz | tar xz
sudo mv gh-relay /usr/local/bin/

# Linux (amd64)
curl -L https://github.com/soub4i/gh-relay/releases/latest/download/gh-relay_linux_amd64.tar.gz | tar xz
sudo mv gh-relay /usr/local/bin/

# Windows (amd64) - run in PowerShell
Invoke-WebRequest -Uri https://github.com/soub4i/gh-relay/releases/latest/download/gh-relay_windows_amd64.zip -OutFile gh-relay.zip
Expand-Archive gh-relay.zip

Requires Go 1.22+.

git clone https://github.com/soub4i/gh-relay
cd gh-relay
go build -o gh-relay .
sudo mv gh-relay /usr/local/bin/

You need at least one tunnel provider installed:

export GH_RELAY_TOKEN=ghp_YourPersonalAccessToken
gh-relay share --repo my-org/private-app --expire 1h

If both --token and GH_RELAY_TOKEN are set, --token takes precedence (a warning is logged).

Tip: Avoid exposing your token in shell history by using GH_RELAY_TOKEN instead of --token.

gh-relay share --repo my-org/private-app

gh-relay share --repo my-org/private-app --expire 30m

--expire 30m

### Share a specific branch

```bash
gh-relay share --repo my-org/private-app --branch feature/new-auth

Use --allow to expose only matching repository paths. Use --deny to hide matching paths; deny rules always take precedence over allow rules.

gh-relay share --repo my-org/private-app --allow "src/**,docs/**,README.md"

gh-relay share --repo my-org/private-app --allow "src/**,docs/**,README.md" --deny ".env,.env.*,secrets/**,*.pem"

Filters are enforced server-side for both /api/tree listings and /api/blob file access, so a guest cannot bypass a hidden path by manually requesting a blob SHA. Patterns are globs; use .env,.env.* if you want to hide both .env and files like .env.local.

gh-relay share --repo my-org/private-app --tunnel ngrok

gh-relay share --repo my-org/private-app --tunnel none --port 8080
# Open http://localhost:8080 in your browser

Use --passcode to protect the shared URL with a short code. gh-relay prints the URL and access code separately; the guest must enter the code before the repository browser loads.

gh-relay share --repo my-org/private-app --passcode

You can also choose the code yourself. Explicit values must use --passcode=value, must be 8-128 characters, and cannot be true or false. Prefer generated codes when possible so the access code does not land in shell history or process listings.

gh-relay share --repo my-org/private-app --passcode=review-483920

The access code helps if a URL is accidentally forwarded. It is still a shared secret; anyone with both the URL and code can open the session until it expires or you stop gh-relay.

Before a share session starts, gh-relay scans the selected branch's shareable repository tree for sensitive-looking paths such as .env, .env.*, *.pem, *.key, id_rsa, id_ed25519, secrets/, credentials.yml, config/credentials.yml, *.p12, *.pfx, kubeconfig, .npmrc, .pypirc, and terraform.tfvars. If --allow or --deny is set, those filters are applied before the warning scan.

Path scanning is enabled by default:

gh-relay share --repo my-org/private-app

You can also scan small text files for common high-risk patterns such as AWS access key IDs, GitHub token prefixes, private key headers, and simple assignments like password=, secret=, api_key=, or token=:

gh-relay share --repo my-org/private-app --scan-content

If findings are detected, gh-relay prints only the file path, finding type, severity, and rule name. It never prints matched secret values.

⚠️  Potential sensitive files or secrets detected before sharing:

HIGH    path     .env                         matched rule: dotenv file
HIGH    path     deploy/prod.pem              matched rule: private key/certificate file
MEDIUM  content  config/settings.yml          matched rule: generic token assignment

gh-relay does not print secret values. Review these files before exposing this repo.

Continue sharing? [y/N]:

In non-interactive mode, gh-relay prints the warning and continues unless --fail-on-secrets is set:

gh-relay share --repo my-org/private-app --fail-on-secrets

To skip this preflight scan:

gh-relay share --repo my-org/private-app --no-scan-secrets

This is a best-effort warning system, not a full security scanner. It does not scan Git history, all branches, generated artifacts outside the selected tree, large blobs, binary files, encrypted files, or every possible secret format. Review sensitive repositories before exposing them.

gh-relay share --repo my-org/private-app --audit

Logs guest activity to the terminal and prints a summary on exit:

[audit] Guest viewed: src/main.go (from 105.190.183.127)
[audit] GET /api/commits (from 105.190.183.127)

  SESSION AUDIT SUMMARY
  Files viewed  : 5 (3 unique)
  Total requests: 12
  Unique IPs    : 1
  Duration      : 4m32s

gh-relay share --repo my-org/private-app --allow-download

A "Download ZIP" button appears in the guest's browser. The ZIP is streamed directly from GitHub through the proxy — nothing is written to disk. Off by default since a downloaded ZIP gives the guest a permanent copy.

gh-relay is designed from the ground up to share as little as possible.

For fine-grained PATs (recommended):

• Contents: Read-only
• Metadata: Read-only

For classic PATs:

• repo | for private repositories
• public_repo | for public repositories only

Tip: Create a dedicated PAT for gh-relay sessions with the minimum required scopes and a short expiry matching your longest expected review session.

Quick start: Generate a classic PAT with repo scope at https://github.com/settings/tokens/new?scopes=repo

The guest opens the URL in any browser, no GitHub account, no sign-in, no extension required. If --passcode is enabled, they enter the access code first. They see:

• A file tree with folder expand/collapse and a live filter
• A code viewer with line numbers for text files
• A branch switcher to explore other branches
• A commit history panel showing recent commits on the active branch

They cannot clone, push, download a zip, or navigate outside the repository you shared.

├── cmd
│   ├── root.go
│   └── share.go // CLI command definitions and flag parsing
├── go.mod
├── internal
│   ├── filter
│   │   ├── policy.go // Server-side path allow/deny policy
│   │   └── policy_test.go
│   ├── github
│   │   ├── client.go // GitHub API client and handlers
│   │   ├── types.go
│   │   └── utils.go
│   ├── logo
│   │   └── logo.go
│   ├── server
│   │   ├── server.go // HTTP server and handlers
│   │   ├── spa.go
│   │   ├── types.go
│   │   └── utils.go
│   ├── secretscan
│   │   ├── scanner.go // Pre-share path and content secret-risk scanner
│   │   ├── scanner_test.go
│   │   └── types.go
│   ├── session
│   │   ├── manager.go 
│   │   ├── types.go
│   │   └── utils.go
│   ├── tunnel
│   │   ├── cf.go // Cloudflare tunnel support
│   │   ├── ngrok.go // ngrok tunnel support
│   │   └── tunnel.go // Tunnel interface and factory
│   └── version
│       └── version.go
├── LICENSE
├── main.go
└── README.md

Zero external Go dependencies.

Contributions are welcome. Please open an issue before starting work on a large change so we can discuss the approach first.

# Run tests
go test ./...

# Run with race detector
go test -race ./...

# Vet
go vet ./...

# Build
go build -o gh-relay .

• File browsing, code viewing, Cloudflare tunnel
• Branch switcher, commit history
• Markdown rendering for README files
• System keychain integration for token storage
• Optional access code protection for the shared URL
• gh CLI extension (gh relay share ...)

MIT - © 2025 soub4i

gh-relay is intended for internal collaboration and peer review. Always ensure that sharing code via a relay complies with your organisation's data-handling policies and Terms of Service