I've done exactly they same for many years via email aliases in MS Exchange. I too discovered that the only real sharing/leaking of email addresses was my paypal and ebay ones, and a legacy one that I used to use on USEnet back when we all didn't know better.

My take-away was: always proxy ebay/paypal accounts behind another mail provider, and be ready to change those emails when they get compromised.

> I hide my email address by using Fastmail which supports wildcard user

Yes this service is not a new thing, and people come up with different ways to solve this problem.

> FYI, after years of running this experiment I’ve found that vendors don’t tend to share their email address lists.

I pretty much agree with you. But it happens, and I do feel better knowing even if they do, I needn't worry :)

I've gotten a fair few emails to my address used for git commits also. Doubt each recruiter is compiling it manually, but someone must have built a script that cloned git repos and inspected the data, as I don't think GitHub shows it in the UI

> I don't think GitHub shows it in the UI

Add `.patch` to the end of the URL when viewing a commit to view the full commit, including user information. E.g., ‘https://github.com/<repo>/commit/<hash>.patch’.

That's true. you can also put .keys or .gpg on the end of a user profile to get ssh or gpg public keys respectively (also works for GitLab). I guess I've always just considered such routes to be part of the API since they're not linked in the UI