[tedivm]

Half the time they literally say it in the email. I just looked in my spam folder and just a few hours ago got an email titled "Your profile: Github", that started with:

> I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out. > > Profile: https://github.com/tedivm

They aren't doing anything to hide it.

[grepfru_it]

But hold on.

They could have git cloned your repo, used or otherwise analyzed your code which follows TOS then used the local git repo to pull your email address.

How is GitHub responsible here?

[influx]

They could have, but it seems unlikely they targeted one or two repos and probably cloned thousands or more.

[eli]

That identifies the company that sent the email not the github account that scraped it