How to Remove a Secret From Git History

Why deleting the file is not enough

Running git rm .env && git commit removes the file from the working tree and the next commit's tree, but every earlier commit still contains it. Anyone who clones the repo, runs git log -p, or checks out an old ref gets the plaintext secret. Git history is a linked chain of snapshots - to scrub a file you have to rewrite every snapshot that contains it.

Step 1: prevent re-commit with .gitignore

Before rewriting anything, make sure the file cannot come back:

echo ".env" >> .gitignore
git add .gitignore
git commit -m "chore: gitignore .env"

Step 2: rewrite history with git filter-branch

git filter-branch --index-filter runs a command against every commit's index (the staging area) without checking files out to disk - much faster than --tree-filter:

git filter-branch --force \
    --index-filter "git rm --cached --ignore-unmatch .env" \
    --prune-empty -- --all

• --force overwrites any existing backup refs from a previous run.
• --ignore-unmatch skips commits that never had .env (avoids an error).
• --prune-empty removes any commits whose tree becomes empty after the removal.
• -- --all rewrites every branch and tag, not just HEAD.

Step 3: delete the backup refs git left behind

git filter-branch saves the original commits under refs/original/ so you can undo. Those refs still point at history containing the secret, so drop them:

git for-each-ref --format="%(refname)" refs/original/ \
    | xargs -n 1 git update-ref -d

Then verify the secret is gone from all reachable history:

git log --all -p | grep AWS_SECRET_ACCESS_KEY
# should print nothing

What to do if the secret already pushed

History rewriting on a remote repo is destructive: every collaborator's clone still has the old history. If the commit was pushed to a public or shared remote:

1. Rotate the key immediately - treat it as compromised, full stop.
2. Force-push the rewritten history: git push --force --all (coordinate with the team first).
3. Ask collaborators to re-clone or run git pull --rebase against the new history.

Prefer git filter-repo for real incidents

git filter-branch is slow on large repos and has sharp edges. The community tool git filter-repo (a single Python script) is faster, safer, and more explicit - it is now the recommended approach in the git documentation:

pip install git-filter-repo
git filter-repo --path .env --invert-paths

Either way, rotate the secret - history scrubbing removes it from future clones, not from anyone who already has it.