asked 4 months ago
2
14.7K
I accidentally pushed a commit with sensitive data (API key) to a public GitHub repo. I need to remove it.
I know git revert creates a new commit undoing the changes. But the sensitive data is still in the git history — is that a problem? What's the cleanest way to handle this without breaking my team's workflow?
GitHub has a "Secret scanning" feature that will alert you if a known API key format is detected in a push. Enable it in your repo settings — it's free for public repos.
For prevention: use git-secrets or detect-secrets as pre-commit hooks to block secrets from ever being committed.
Step 1: Revoke the API key immediately. Before anything else. Even if you fix the git history, crawlers may have already indexed the commit.
Step 2: Use git revert to create a new commit that undoes the changes:
git revert <commit-hash>
git pushThis preserves history and is safe for shared branches. The sensitive data is still in history, but since the key is revoked it's no longer a live vulnerability.
Step 3: If you want to purge history (optional, for compliance): use git filter-repo (not filter-branch) and force-push. But this rewrites history and will require all collaborators to re-clone. Coordinate with your team.
pip install git-filter-repo
git filter-repo --path .env --invert-paths
git push --force-with-lease1
61
7
24
5
34
4