Safely remove a leaked secret from Git history

Security

A credential was committed and must be revoked and removed.

  1. Revoke/rotate secret first

    # rotate credentials in provider console
    Destructive

  2. Scan for remaining leaks

    git grep -n '<secret-pattern>'

  3. Rewrite history

    git filter-repo --path <file> --invert-paths
    Destructive

  4. Force push rewritten refs

    git push --force --all
    Destructive

Notes

  • Secret rotation is the first priority; history rewrite is second.
  • Coordinate with the team before force-pushing rewritten history.

Related commands: git filter-repo, git push --force-with-lease, git reflog

Related workflows: Remove sensitive files from Git history