Demo Scrub Compromised Secrets git filter repo

​

Lesson overview

• Create a small test repo on GitHub.
• Simulate a leaked secret by committing a test file.
• Revoke the secret in any external service.
• Use git-filter-repo --replace-text to remove or replace the value across history.
• Force-push the new history and coordinate with collaborators.

​

Create a test repository on GitHub

​

Simulate a leaked secret (local)

1. Clone the repo locally.
2. Create a secret.txt file containing a mock secret:

password=1234567

3. Commit and push the file:

git add secret.txt
git commit -m "added secret - 1"
git push origin main

To https://github.com/sid-dev2-kk/test-secret
   d8f5de1..ef9bc14  main -> main

​

Removing the file from the tip (does not remove it from history)

# delete locally and commit removal
rm secret.txt
git add .
git commit -m "removed secret file - 2"
git push origin main

​

Use git-filter-repo to replace the secret across history

pip3 install git-filter-repo

• Operate on a fresh clone in a separate directory to avoid corrupting active clones.
• Rewriting history requires a force-push and coordination with all collaborators because commit IDs will change.
• For rewriting all refs and tags, use a mirror clone.

1. Clone the repo into a fresh folder (example cleanup-repo):

git clone https://github.com/sid-dev2-kk/test-secret cleanup-repo
cd cleanup-repo

git clone --mirror https://github.com/sid-dev2-kk/test-secret cleanup-repo.git
cd cleanup-repo.git

2. Create a replace-file listing the target text and replacement. Format is OLD==>NEW. For this demo we replace 1234567 with ***REMOVED***. Save it as /tmp/mock-expression.txt:

# /tmp/mock-expression.txt
1234567==>***REMOVED***

• Lines beginning with # are comments.
• Matches are literal by default; include exact surrounding characters if needed.

3. Run git-filter-repo with the replace-text option:

git filter-repo --replace-text /tmp/mock-expression.txt

Parsed 3 commits
New history written in 0.01 seconds; now repacking/cleaning...
Repacking your repo and cleaning out old unneeded objects
HEAD is now at 0fcc945 removed secret file - 2
Completely finished after 0.04 seconds.

4. Re-add remote (if needed) and force-push the rewritten history back to GitHub:

git remote add origin https://github.com/sid-dev2-kk/test-secret
git push origin --force --all
# Also push tags if you have them
git push origin --force --tags

git push --mirror --force

To https://github.com/sid-dev2-kk/test-secret
 + 95ac935...0bb8eb1 main -> main (forced update)

​

Verify the result on GitHub

• Refresh the repository and inspect older commits that previously contained the secret. The sensitive value should now be replaced by ***REMOVED*** (or the replacement text you specified) across rewritten commits.
• Keep in mind scrubbing Git history does not affect copies of the repository cloned elsewhere, CI logs, or third-party backups. Search for other exposures and rotate credentials where necessary.

​

Quick reference — common commands

​

Links and references

• git-filter-repo GitHub: https://github.com/newren/git-filter-repo
• GitHub guide to removing sensitive data: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
• Git official docs: https://git-scm.com/docs

​

Summary

• Immediately revoke or rotate any compromised secrets before attempting history edits.
• Use git-filter-repo --replace-text to remove or replace sensitive strings across all commits.
• Work on a fresh clone (or mirror clone for all refs), force-push the rewritten history, and coordinate with collaborators because history rewriting is disruptive and irreversible for existing clones.