The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If an API key, token, password, or other credential appears in a GitHub repository, treat it as compromised. First identify the credential and its provider, then revoke or rotate it and update every service that depends on it. Deleting the string from the current file does not invalidate it or erase earlier commits. Clean Git history only if the residual exposure justifies the disruption.
How do you find exposed secrets in a GitHub repository?
Start with the repository’s secret-scanning alert if one exists. Identify the credential type, issuing provider, repository and file location, and the person or team responsible for it. Check alert details for exposure context, repeated appearances, and any validity or use information GitHub provides for some token types. The provider is the most reliable authority on whether a credential still works. See GitHub’s remediation guidance.
As an Amazon Associate I earn from qualifying purchases.
- Note where the value appeared and whether the repository is public, private, or internal.
- Determine which applications, deployments, integrations, or users rely on the credential.
- Assess what access it grants, especially whether it protects production systems or sensitive data.
- If scanning is unavailable, inspect the relevant file and repository activity, and check provider or service logs where available.
GitHub Secret Scanning checks Git history on all branches for recognized patterns, but coverage depends on repository eligibility and supported patterns. Public repositories receive scanning automatically for free. Organization-owned private and internal repositories require GitHub Secret Protection on eligible GitHub Team or Enterprise Cloud plans. An alert’s absence does not prove that no secret was exposed: a credential may not match a supported pattern or scanning may not be available for that repository. Details are in the Secret Scanning overview and detection scope documentation.
Move urgently if the credential is exposed publicly or protects production or sensitive resources. GitHub warns that automated scanners may find public secrets quickly, and an attacker may exploit them quickly; this is a qualitative warning, not a fixed response-time estimate.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should you do first: revoke or rotate the credential?
Contact the credential’s issuing provider and follow its revocation process. If a replacement is needed, create it and update dependent services so they no longer use the exposed value. Depending on the credential and the risk of downtime, you may need to move services to a replacement before revoking the old one; prioritize prompt invalidation when the exposure is high risk.
- Find the provider’s revocation instructions. Do not assume GitHub can invalidate a credential issued by another service.
- Revoke the exposed value, or replace it through a controlled transition. Confirm with the provider that the old credential is no longer usable.
- Update dependencies. Replace the value in applications, deployments, integrations, repository secrets, or deploy-key configurations that used it.
- Check service behavior. Confirm the updated systems work and inspect relevant logs for suspicious use where those logs are available.
- Resolve the alert and document the response. Once the credential is invalidated and dependencies are updated, mark the secret-scanning alert as revoked and record the incident and follow-up actions.
GitHub automatically revokes GitHub personal access tokens (PATs) leaked in public repositories. For a leaked GitHub PAT in a private repository, GitHub says a user can report it from the secret-scanning alert. For other supported partner patterns found in a public repository, GitHub may report the leak to the provider, which may revoke the credential. These behaviors are not a reason to skip provider confirmation or your own incident response. GitHub explains the alert and remediation process in its leaked-secret remediation guide.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Is deleting a leaked API key from the file enough?
No. Removing the value from the current file and pushing a new commit does not invalidate it, and the secret may still exist in earlier commits, branches, forks, pull requests, or cached views. GitHub states that simply removing a secret from the codebase, pushing a new commit, or deleting and recreating the repository does not prevent exploitation. Revoke or rotate the credential with its provider first; file editing is not a substitute.
Recommended Free Tools
Should you remove a secret from Git commit history?
History rewriting is a separate decision from revocation. Once the credential is revoked or rotated, it can no longer grant access; GitHub says that may be enough, and rewriting history can be time-consuming and disruptive. Consider a purge when the secret string itself creates residual harm or when security, compliance, contractual, or other obligations call for removal.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Option | When it fits | Main trade-off |
|---|---|---|
| Revoke or rotate, leave history intact | The credential is confirmed unusable, and retaining the string does not create unacceptable residual risk or violate an obligation. | The old string remains in Git history and may remain in copies, but history and collaborator workflows are not disrupted by a rewrite. |
| Revoke or rotate, then rewrite history | The residual presence of the string warrants cleanup and repository owners can coordinate the work. | Commit hashes change; signatures, tooling, pull-request diffs, clones, forks, and concurrent work may be affected. |
Make the decision with the repository’s security leads and credential owner. Weigh the sensitivity of the data, obligations, residual harm from the string, and the ability to coordinate cleanup without old clones reintroducing it. GitHub’s sensitive-data removal guide describes the risks and process.
How do you remove a secret from Git history?
For a justified cleanup, GitHub documents using git-filter-repo, verifying the rewritten repository, and force-pushing the affected refs. The GitHub documentation reviewed specifies version 2.47 or later for the --sensitive-data-removal flag. Plan the rewrite before running it: mirror force-pushing can overwrite branches, tags, and refs and may discard concurrent changes.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Coordinate a freeze or other safe window. Tell collaborators and automation owners to stop pushing changes that could conflict with the rewrite.
- Choose the cleanup method. Removing a file by path must account for renamed or moved versions of that path. Replacing a secret string requires a replacement list.
- Rewrite and verify the repository. Follow GitHub’s current history-removal instructions and confirm the sensitive value is absent from the rewritten refs.
- Force-push the rewritten refs in a coordinated operation. Ensure the team understands that old commit IDs are no longer the rewritten history.
- Clean up old copies. Collaborators need to clean or replace old clones and rebase their branches rather than merge tainted history back in. Fork owners may need to clean their own copies.
- Check for cached views or references. In eligible sensitive-data cases, GitHub Support may remove cached views and references after cleanup. Support does not remove non-sensitive data and may decline if credential rotation sufficiently mitigates the risk.
A rewrite can invalidate commit signatures, break systems that depend on commit hashes, and disrupt pull-request diffs. It also cannot ensure that every fork, clone, or cached copy disappears. Do not treat history cleanup as a substitute for revocation.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Where else should you look for copies or related access?
After addressing the credential, search the organization and repository for the exact secret value using GitHub code search. Avoid putting the exposed value in public notes, tickets, or communications while doing so.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Review other repository files and branches, including likely renamed or copied files.
- Inspect deploy keys, stored secrets and variables, installed GitHub Apps, and integrations that could hold related access.
- Check dependent services and their logs for unexpected use when those records are available.
- After a history rewrite, coordinate clone, branch, and fork cleanup so old history is not pushed back into the repository.
How can you prevent another secret from being committed?
Enable push protection where available
Push protection can block supported secret patterns before they enter a protected repository. GitHub also offers user-level protection for pushes to public repositories. Its coverage is limited: it blocks only supported patterns, some older token patterns may not be supported, large pushes can time out, public-repository pushes over 50 MB are skipped, and it does not necessarily block secrets that already have alerts. Secret Scanning can still create alerts after a push. Check the current scope and limitations and enablement instructions for repository-specific availability.
Keep credentials out of source code
Use environment variables or a managed secret service to provide credentials at runtime rather than hardcoding them in tracked files. GitHub names Azure Key Vault, AWS Secrets Manager, and HashiCorp Vault as examples. A .gitignore entry can help keep a local secret file out of future commits, but it does not remove a value already committed to history. GitHub also suggests pre-commit checks such as git-secrets or gitleaks; these complement, rather than replace, provider revocation and repository scanning. See GitHub’s prevention and removal guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
