Look where the developer chose to publish one: the email field of their profile, their profile README, and the website linked from their profile. In our index, 39,305 of the 99,698 active developers whose location is known publish an email that way. Other routes exist, the most known being the author address recorded in git commits, readable by adding .patch to a commit URL. It is technically public and you should not use it: it was recorded by git, not offered as a contact, and writing to it tells the person you went looking for something they kept back.
Where developers publish an address on purpose
- The email field of the profile. Shown under the name when the person made it public. The clearest consent signal there is.
- The profile README. The repository named after the user, shown at the top of their profile, often ends with a "reach me" line.
- The linked website or blog. A contact page or an address in the footer is an invitation, and a message that mentions what they wrote lands well.
- A LinkedIn or social profile linked from GitHub. Not an email, but a route they put there themselves.
Routes that exist, and why they are off limits
These work technically. That is the problem: each one reaches an address the person did not offer as a contact.
- Commit metadata. Git records an author email on every commit, and adding
.patchto a commit URL displays it. GitHub provides a noreply address precisely so developers can keep theirs out, which tells you what the expectation is. - Package registries. npm or PyPI metadata sometimes carries a maintainer address. It is there for users of the package, not for recruiters.
- Signing keys and API payloads. Public keys and some API events can embed an address. Using them is reading data meant for machines.
- Enrichment tools that guess work emails. A different activity, with its own legal profile, and not one this page recommends.
In the EU, an address is personal data however you found it, and processing it under legitimate interest requires that the person could reasonably expect it. A commit address fails that test far more easily than one printed on a profile. The details are in is it legal to source developers on GitHub.
What to do when there is no address
Use the next published route: the linked LinkedIn profile, the website's contact form, or a handle they listed. When nothing is published, that is an answer too. Our page on contacting developers with no public email measures how large that group really is.
How StarHunt handles it
StarHunt shows the email and the LinkedIn profile a developer published, and nothing else. It does not read commit metadata and does not guess work addresses. Figures in this page come from StarHunt's own index of 330,000+ public GitHub profiles, measured in October 2026. Method and full breakdown: State of Developer Reachability 2026.
Where this answer does not hold
Some developers publish no route at all. No method on this page changes that, and none should try.
Frequently asked questions
Can you see a GitHub user's email?
Only if they made it public on their profile or published it in their README or website. Many keep it private, which GitHub supports by default.
Is the email in git commits public?
It is readable, because git records the commit author, but it was not offered as a contact address. Using it for outreach is the fastest way to be treated as a scraper.
What share of developers publish an email on GitHub?
Among the 99,698 active developers in our index whose location is known, 39,305 publish an email, and a further 21,129 publish a LinkedIn profile and no email.
Is it legal to email a developer found on GitHub?
Generally, when you use an address they published and the role is relevant to their work, with a clear way to opt out. Rules differ by country; this is not legal advice.
Only the routes they published
StarHunt shows each developer's public email and LinkedIn, ready to export.
Try StarHunt for freeThis page describes how recruiting teams generally handle these rules. It is not legal advice, it is not written by a lawyer, and it does not account for your country, your sector or your contracts. Have your own counsel confirm anything you intend to rely on.