> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# You Pushed Secrets to GitHub
> Guide for handling accidentally committed secrets to GitHub, rotate credentials immediately, purge them from git history, and enable pre-commit and CI secret scanning.
Scenario: You’re working late and accidentally commit AWS secret keys to a public GitHub repository. You immediately run `git revert` and push again. Does that solve the problem?
Short answer: No.
`git revert` creates a new commit that undoes the change, but the original commit containing the secret still exists in the repository history. Anyone (or any bot) can view older commits or run `git log` to recover the secret.
Automated scanners and harvesting bots are constantly monitoring public pushes. Within seconds or minutes of the push, the exposed keys can be grabbed and used. Cloud providers (like AWS) may detect and notify you, but that notification often arrives after the key has already been exploited.
Immediate action: follow these three steps in this exact order
1. Rotate the secret immediately (revoke it).
2. Purge the secret from Git history (rewrite history).
3. Prevent future leaks by adding local scans / pre-commit hooks.
***
## Detailed steps
### Step 1 — Rotate the secret (do this immediately)
Assume the key is compromised as soon as it was exposed. Do not spend time trying to remove the commit before rotating credentials.
* Revoke or delete the compromised key in the cloud provider console or via CLI.
* Create a new key and update any services that used the old one.
* Notify affected developers or systems so they can update their configurations.
Example AWS CLI commands:
```shell theme={null}
# List access keys for a user
aws iam list-access-keys --user-name YOUR_USER
# Deactivate a key (optional, before deleting)
aws iam update-access-key --user-name YOUR_USER --access-key-id AKIAEXAMPLE --status Inactive
# Delete the compromised key
aws iam delete-access-key --user-name YOUR_USER --access-key-id AKIAEXAMPLE
# Create a new key (outputs JSON with the new credentials)
aws iam create-access-key --user-name YOUR_USER
```
Why rotate first? If the secret remains valid while you rewrite history, attackers can continue to use it even after you remove it from commits.
***
### Step 2 — Purge the secret from Git history (rewrite history)
After credentials are rotated and invalidated, rewrite repository history to remove the secret from all commits. The two commonly used tools:
* `git-filter-repo` (recommended, actively maintained)
* BFG Repo-Cleaner (simpler for straightforward file deletions)
Important: Both approaches require a mirrored clone and will change commit SHAs. After forced-pushing the cleaned history, everyone with clones must re-clone or reset; forks and mirrors may still contain the secret.
Example: remove a file from all commits with `git-filter-repo`:
```shell theme={null}
# Clone a bare mirror
git clone --mirror git@github.com:your/repo.git
cd repo.git
# Remove a specific file from all commits
git filter-repo --invert-paths --paths path/to/secret.file
# Expire reflog, run GC, and force-push cleaned history
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force
```
Example: redact specific secret strings with `git-filter-repo`:
```shell theme={null}
# Create a replace-text file (format: "literal==>replacement" or just "literal")
# secrets-to-redact.txt content example:
git clone --mirror git@github.com:your/repo.git
cd repo.git
# Replace / redact strings listed in secrets-to-redact.txt
git filter-repo --replace-text ../secrets-to-redact.txt
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force
```
Example: remove files using BFG (good for deleting private keys, etc.):
```shell theme={null}
# Mirror clone
git clone --mirror git@github.com:your/repo.git
java -jar bfg.jar --delete-files id_rsa repo.git
cd repo.git
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force
```
Operational notes:
* Coordinate with your team before force-pushing rewritten history.
* Ask collaborators to re-clone or reset their local repositories to avoid reintroducing old commits.
* If the repository was forked or mirrored externally, those copies may still contain the secret — contact maintainers or owners of forks if possible.
Rewriting history and force-pushing affects every collaborator and all clones. Coordinate and require everyone to re-clone or perform a clean reset. Never force-push to shared branches without communication.
***
### Step 3 — Prevent future leaks (scan before commit)
Add automated checks to catch secrets before they are committed and pushed. Implement pre-commit hooks and CI scanning.
Popular tools:
* detect-secrets — heuristic-based secret scanner (Yelp)
* gitleaks — fast, configurable detection tool
* pre-commit — hook framework to run detection tools locally
Example `.pre-commit-config.yaml` using `detect-secrets` and `gitleaks`:
```yaml theme={null}
repos:
- repo: https://github.com/Yelp/detect-secrets
rev: v1.3.0
hooks:
- id: detect-secrets-hook
args: ['--baseline', '.secrets.baseline']
- repo: https://github.com/zricethezav/gitleaks
rev: v8.2.0
hooks:
- id: gitleaks
args: ['--verbose']
```
Install and enable pre-commit locally:
```shell theme={null}
pip install pre-commit
pre-commit install
pre-commit run --all-files # test it now
```
Short checklist when you discover leaked secrets:
1. Rotate/revoke the secrets immediately.
2. Rewrite Git history to remove secrets.
3. Force-push the cleaned history and coordinate with your team.
4. Add pre-commit hooks and CI scanning to prevent recurrence.
***
## Tools and quick references
| Tool / Resource | Purpose | Example / Link |
| ----------------- | -------------------------------------------------------: | ---------------------------------------------------------------------------------------- |
| `git-filter-repo` | Recommended for history rewriting and string replacement | [https://github.com/newren/git-filter-repo](https://github.com/newren/git-filter-repo) |
| BFG Repo-Cleaner | Easy removal of files from history | [https://github.com/rtyley/bfg-repo-cleaner](https://github.com/rtyley/bfg-repo-cleaner) |
| detect-secrets | Secret detection for pre-commit/CI | [https://github.com/Yelp/detect-secrets](https://github.com/Yelp/detect-secrets) |
| gitleaks | Fast secrets detection with many presets | [https://github.com/zricethezav/gitleaks](https://github.com/zricethezav/gitleaks) |
| pre-commit | Framework to run hooks locally before commit | [https://pre-commit.com/](https://pre-commit.com/) |
***
## Final notes / best practices
* Rotating credentials immediately is the top priority. Cleaning Git history is important but secondary—do it after rotation.
* Automate secret detection in local development and CI to stop leaks before they reach remote repositories.
* Treat any secret exposed in a public repository as compromised: assume it was collected and acted upon.
* Maintain an incident playbook that includes credential rotation, history cleaning, and team communication steps.
### Links and references
* [git-filter-repo](https://github.com/newren/git-filter-repo)
* [BFG Repo-Cleaner](https://github.com/rtyley/bfg-repo-cleaner)
* [detect-secrets (Yelp)](https://github.com/Yelp/detect-secrets)
* [gitleaks](https://github.com/zricethezav/gitleaks)
* [pre-commit](https://pre-commit.com/)