Secrets Don't Expire When You Delete Them: Cleaning Up Git History

In brief: A leaked API key committed to a repo stays in the history long after the file is deleted. Detection, rotation, and history rewriting are all required — deletion alone is a false sense of safety.

The delete-commit trap

When a developer notices a committed credential, the instinct is to delete the line and push a fix. But the secret is still sitting in the git history, retrievable by anyone with clone access. If the repo was ever public or mirrored, assume the secret is compromised the moment it was pushed.

The only safe assumption is that a leaked secret is a live secret until it is rotated.

The real remediation sequence

• Rotate the credential immediately — treat it as breached, not just exposed.
• Revoke and audit for any use of the leaked key during the exposure window.
• Rewrite history to purge the secret from all reachable commits and force-refresh mirrors.
• Add pre-commit and CI secret scanning so the next one is caught before it lands.

Detection has to be continuous

Secret leaks are not a one-time cleanup; they are an ongoing detection problem. Scanning only at commit time misses secrets pushed through other paths, and scanning only historically misses tomorrow's mistake. Both matter.

KENSAI's scanning surfaces exposed credentials with the context needed to prioritize rotation — which key, where it is reachable, and how urgent the exposure is.

What good hygiene looks like in practice

Treat every secret that has ever touched a repository as already exposed, and design so that exposure is survivable. Short-lived, automatically rotated credentials turn a leaked key into a problem that expires on its own rather than an open door that stays open for months.

Push detection left with pre-commit and pre-receive hooks that block a secret before it is ever recorded, and pair that with server-side scanning that catches what slips through. The goal is not a one-time cleanup but a standing control that makes new leaks rare, loud, and quick to revoke.

Takeaway

Deleting a leaked secret is the least important step. Rotate first, purge history second, and put continuous detection in place so exposure windows shrink instead of repeating.