Gitflow
🔐Pushed a Secret to GitHubExpert+900 XP
Scenario reference

Pushed a Secret to GitHub: the situation, step by step

The situation

You accidentally committed `.env` with the production AWS keys and pushed. Rotating the key is step zero — but you also need it gone from history.

Rotate the key first. `git rm --cached` stops tracking the file from here on; scrubbing it out of every past commit needs git-filter-repo or BFG, which run outside this browser.

Expert · 7 steps · +900 XP

What you will practice

This scenario walks through 7 steps, in order:

  1. 01List what's tracked to confirm the leak
  2. 02Stop tracking .env — it stays on disk, leaves the index
  3. 03Ignore it so nobody re-adds it by accident
  4. 04Stage the ignore rule
  5. 05Commit the removal so no future commit carries the key
  6. 06Force-push the corrected branch
  7. 07Garbage-collect to drop the old objects locally
Reveal the step-by-step commands

Try the terminal first — you learn more by doing. When you want to check yourself, here is the command for each step.

  1. 1. List what's tracked to confirm the leak
    git ls-files
  2. 2. Stop tracking .env — it stays on disk, leaves the index
    git rm --cached .env
  3. 3. Ignore it so nobody re-adds it by accident
    echo ".env" >> .gitignore
  4. 4. Stage the ignore rule
    git add .gitignore
  5. 5. Commit the removal so no future commit carries the key
    git commit -m "chore: stop tracking .env"
  6. 6. Force-push the corrected branch
    git push --force-with-lease origin main
  7. 7. Garbage-collect to drop the old objects locally
    git gc --prune=now --aggressive

Key takeaway

Rotate first — that is the only step that actually protects you. Untracking `.env` and adding it to `.gitignore` stops the next leak, but the old commits still hold the key until you rewrite history with git-filter-repo or BFG. Anything pushed to a public remote should be considered compromised forever.

← Browse all scenarios