Secrets in Git: how they leak and how to stop it

Deleting the file doesn’t remove the key. What to do first, and how to stop the next leak.

15 April 2025 · 1 min read

If a password or API key was ever committed, treat it as leaked. Deleting the file doesn’t help. Git keeps it in history, in every clone and every fork, and bots scan public repos for keys within minutes.

First hour:

Revoke the key and issue a new one. This is the real fix.
Check the provider’s logs for use since the commit.
Then clean the history if the repo is public.

Stopping the next one:

Code holds the name of a secret, never the value. Values come from environment variables or a secrets manager.
Commit .env.example; keep .env in .gitignore.
Add a pre-commit scanner like Gitleaks or TruffleHog.
Turn on push protection on GitHub (on by default for public repos) or the GitLab equivalent.
Scan the full history of your existing repos once.

Keys also leak through CI logs, screenshots and Docker images. Same rule: exposed means rotate.