Gitflow
🔐Pushed a Secret to GitHubExpert+900 XP
Workshop
Scenario reference

Pushed a Secret to GitHub: the situation, step by step

The situation

You accidentally committed `.env` with the production AWS keys and pushed. Rotating the key is step zero — but you also need it gone from history.

Rewriting history with filter-repo (or BFG) is required. Force-push to fix remote.

Expert · 4 steps · +900 XP

What you will practice

This scenario walks through 4 steps, in order:

  1. 01List what's tracked to confirm the leak
  2. 02Purge .env from all history
  3. 03Force-push the rewritten history
  4. 04Garbage-collect to drop the old objects locally
Reveal the step-by-step commands

Try the terminal first — you learn more by doing. When you want to check yourself, here is the command for each step.

  1. 1. List what's tracked to confirm the leak
    git ls-files
  2. 2. Purge .env from all history
    git filter-repo --path .env --invert-paths
  3. 3. Force-push the rewritten history
    git push --force-with-lease origin main
  4. 4. Garbage-collect to drop the old objects locally
    git gc --prune=now --aggressive

Key takeaway

Rotate first, rewrite second. Anything pushed to a public remote should be considered compromised forever.

← Browse all scenarios