my-git

Remove Secret from History

English

中文

After committing a secret into Git history, the first step is always to revoke and rotate the keys.

Cleaning up history only reduces further exposure; it cannot make an already leaked secret secure again.

Immediate Action

1. Revoke the secret
2. Rotate to a new secret
3. Confirm access logs and scope of impact
4. Notify related owners
5. Clean up Git history

Clean Up History

Use git filter-repo:

git filter-repo --path path/to/secret-file --invert-paths

Then force push the cleaned history:

git push --force --all
git push --force --tags

Note the Risks

History rewriting affects all collaborators; you must notify the team before execution and require everyone to resynchronize the repository.

After Cleanup

• Check GitHub secret scanning or similar scanning results
• Clean up leaked content in forks and caches
• Add pre-commit scanning
• Document preventive actions in the incident post-mortem

Further Reading

• GitHub Docs: Removing sensitive data from a repository
• GitHub Docs: About secret scanning
• git filter-repo
• Security and Secret Scanning

This site is open source. Improve this page.