You can’t cloak email addresses that are part of the commit itself. If you can access the raw repo, you can access the raw email address.

GitHub already offers an email cloaking mechanism but you have to set it up in your local git config in place of your regular email.

When I was a recruiter, I was using recruiting software that scanned GitHub for email addresses back in 2014.

You'd think by now some recruiters would've figured out the best way to find people who knows X is to search for commits in X and look at the attached email

At least the recruiters who figured that out for me came with higher quality messages and offers.

I dread the day when the London recruiter spam mills figure this out...

Sadly there are vendors now that'll resell that info to recruiters so they can e.g. look at your linkedin and the tool will match it to their github and grab the email from a database built partially with commit emails.

20 or so recruiters over the last 3 years have contacted my github commit address.