You Pushed Secrets to GitHub

Scenario: You’re working late and accidentally commit AWS secret keys to a public GitHub repository. You immediately run git revert and push again. Does that solve the problem? Short answer: No. git revert creates a new commit that undoes the change, but the original commit containing the secret still exists in the repository history. Anyone (or any bot) can view older commits or run git log to recover the secret.

The image illustrates the concept of using "git revert," showing it creates a new commit, with a diagram and the word "WRONG" in bold.

Automated scanners and harvesting bots are constantly monitoring public pushes. Within seconds or minutes of the push, the exposed keys can be grabbed and used. Cloud providers (like AWS) may detect and notify you, but that notification often arrives after the key has already been exploited.

The image discusses how automated bots scan every push for harvesting, warning about potential security issues related to AWS.

Immediate action: follow these three steps in this exact order

Rotate the secret immediately (revoke it).
Purge the secret from Git history (rewrite history).
Prevent future leaks by adding local scans / pre-commit hooks.

The image outlines three steps for managing secrets in Git: rotating secrets, purging them from history, and preventing future issues, using tools like BFG Repo Cleaner, git filter-repo, gitleaks, and detect-secrets.

Detailed steps

Step 1 — Rotate the secret (do this immediately)

Assume the key is compromised as soon as it was exposed. Do not spend time trying to remove the commit before rotating credentials.

Revoke or delete the compromised key in the cloud provider console or via CLI.
Create a new key and update any services that used the old one.
Notify affected developers or systems so they can update their configurations.

Example AWS CLI commands:

# List access keys for a user
aws iam list-access-keys --user-name YOUR_USER

# Deactivate a key (optional, before deleting)
aws iam update-access-key --user-name YOUR_USER --access-key-id AKIAEXAMPLE --status Inactive

# Delete the compromised key
aws iam delete-access-key --user-name YOUR_USER --access-key-id AKIAEXAMPLE

# Create a new key (outputs JSON with the new credentials)
aws iam create-access-key --user-name YOUR_USER

Why rotate first? If the secret remains valid while you rewrite history, attackers can continue to use it even after you remove it from commits.

Step 2 — Purge the secret from Git history (rewrite history)

After credentials are rotated and invalidated, rewrite repository history to remove the secret from all commits. The two commonly used tools:

git-filter-repo (recommended, actively maintained)
BFG Repo-Cleaner (simpler for straightforward file deletions)

Important: Both approaches require a mirrored clone and will change commit SHAs. After forced-pushing the cleaned history, everyone with clones must re-clone or reset; forks and mirrors may still contain the secret. Example: remove a file from all commits with git-filter-repo:

# Clone a bare mirror
git clone --mirror git@github.com:your/repo.git
cd repo.git

# Remove a specific file from all commits
git filter-repo --invert-paths --paths path/to/secret.file

# Expire reflog, run GC, and force-push cleaned history
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force

Example: redact specific secret strings with git-filter-repo:

# Create a replace-text file (format: "literal==>replacement" or just "literal")
# secrets-to-redact.txt content example:
git clone --mirror git@github.com:your/repo.git
cd repo.git

# Replace / redact strings listed in secrets-to-redact.txt
git filter-repo --replace-text ../secrets-to-redact.txt

git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force

Example: remove files using BFG (good for deleting private keys, etc.):

# Mirror clone
git clone --mirror git@github.com:your/repo.git
java -jar bfg.jar --delete-files id_rsa repo.git

cd repo.git
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force

Operational notes:

Coordinate with your team before force-pushing rewritten history.
Ask collaborators to re-clone or reset their local repositories to avoid reintroducing old commits.
If the repository was forked or mirrored externally, those copies may still contain the secret — contact maintainers or owners of forks if possible.

Rewriting history and force-pushing affects every collaborator and all clones. Coordinate and require everyone to re-clone or perform a clean reset. Never force-push to shared branches without communication.

Step 3 — Prevent future leaks (scan before commit)

Add automated checks to catch secrets before they are committed and pushed. Implement pre-commit hooks and CI scanning. Popular tools:

detect-secrets — heuristic-based secret scanner (Yelp)
gitleaks — fast, configurable detection tool
pre-commit — hook framework to run detection tools locally

Example .pre-commit-config.yaml using detect-secrets and gitleaks:

repos:
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.3.0
    hooks:
      - id: detect-secrets-hook
        args: ['--baseline', '.secrets.baseline']

  - repo: https://github.com/zricethezav/gitleaks
    rev: v8.2.0
    hooks:
      - id: gitleaks
        args: ['--verbose']

Install and enable pre-commit locally:

pip install pre-commit
pre-commit install
pre-commit run --all-files  # test it now

Short checklist when you discover leaked secrets:

Rotate/revoke the secrets immediately.
Rewrite Git history to remove secrets.
Force-push the cleaned history and coordinate with your team.
Add pre-commit hooks and CI scanning to prevent recurrence.

Tools and quick references

Tool / Resource	Purpose	Example / Link
`git-filter-repo`	Recommended for history rewriting and string replacement	https://github.com/newren/git-filter-repo
BFG Repo-Cleaner	Easy removal of files from history	https://github.com/rtyley/bfg-repo-cleaner
detect-secrets	Secret detection for pre-commit/CI	https://github.com/Yelp/detect-secrets
gitleaks	Fast secrets detection with many presets	https://github.com/zricethezav/gitleaks
pre-commit	Framework to run hooks locally before commit	https://pre-commit.com/

Final notes / best practices

Rotating credentials immediately is the top priority. Cleaning Git history is important but secondary—do it after rotation.
Automate secret detection in local development and CI to stop leaks before they reach remote repositories.
Treat any secret exposed in a public repository as compromised: assume it was collected and acted upon.
Maintain an incident playbook that includes credential rotation, history cleaning, and team communication steps.

Docker

Kubernetes

CI/CD & DevOps

Security

Networking

Advanced Concepts

Interview Setup

System Design

You Pushed Secrets to GitHub

Detailed steps

Step 1 — Rotate the secret (do this immediately)

Step 2 — Purge the secret from Git history (rewrite history)

Step 3 — Prevent future leaks (scan before commit)

Tools and quick references

Final notes / best practices

Links and references

Watch Video

​Detailed steps

​Step 1 — Rotate the secret (do this immediately)

​Step 2 — Purge the secret from Git history (rewrite history)

​Step 3 — Prevent future leaks (scan before commit)

​Tools and quick references

​Final notes / best practices

​Links and references

Watch Video

Detailed steps

Step 1 — Rotate the secret (do this immediately)

Step 2 — Purge the secret from Git history (rewrite history)

Step 3 — Prevent future leaks (scan before commit)

Tools and quick references

Final notes / best practices

Links and references