What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To find exposed API keys, scan both the files in your repository now and its commit history. A key removed from the latest version can remain in an earlier commit. If a finding could be a real credential, treat it as compromised: revoke or rotate it with the issuer, check for suspicious use, and only then decide whether to remove it from Git history.
Scan the working tree and Git history
A scan of current files can find credentials still present in the repository, but it will miss some keys that were committed and later deleted. Use a scanner that can inspect both the working tree and Git history. Gitleaks documents scanning files or directories as well as Git repositories by parsing git log -p; its repository mode also supports selecting commit ranges. See the Gitleaks documentation for its current options.
As an Amazon Associate I earn from qualifying purchases.
GitHub secret scanning checks repository content for matches to patterns defined for supported secret types. It can complement a deliberate history scan, but a clean result should not be read as proof that no credential was ever exposed: scanner coverage depends on the patterns and content it checks. See GitHub’s explanation of secret-scanning alerts.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPractical scan sequence
- Scan files and directories. Run a secret scanner against the repository’s current working tree, including relevant configuration and scripts.
- Scan Git history. Use the scanner’s repository mode, and include the relevant commit range if you are investigating a particular period. Do not assume that deleting a key from the current file removed it from earlier commits.
- Review host alerts. If the repository host offers secret scanning, check its alerts alongside scanner results. A local scan and host-side detection have different coverage and reporting contexts.
Triage a match without exposing it further
A scanner match is a lead to investigate, not by itself proof that a currently valid key was exposed. Determine whether the string is a real credential, which service issued it, whether it remains valid, and where it appeared. GitHub’s incident guidance recommends assessing a secret’s location, exposure, and validity; use its investigation areas as a checklist.
#1 Best Overall
- Record the repository, file, commit, and location needed to find and remediate the finding.
- Do not copy the full secret into an issue, chat, log, or public report. Share only the minimum identifying detail needed, using your team’s approved secure incident channel.
- Check whether the value is a real credential and whether the issuer still accepts it. If you cannot establish that it is harmless, treat it as potentially compromised.
Revoke or rotate a potentially exposed key first
If the key may be real, revoke it or rotate it through the issuing service’s process before attempting to clean Git history. Removing text from a file or rewriting commits does not invalidate the credential; anyone who obtained a copy may still be able to use it. GitHub’s sensitive-data removal guidance likewise puts revocation or rotation before history removal.
Update applications and deployment environments to use the replacement credential, then confirm that the old one is no longer accepted where the issuer provides a way to verify this. Avoid putting the new key into the same tracked files or incident notes that exposed the old one.
Check whether the credential was used
Where the issuing service provides audit or usage logs, review activity associated with the compromised credential. Look for activity, actors, or IP addresses that your team does not recognize, and preserve relevant evidence according to your incident-response process. The available logs and their detail depend on the issuer, so absence of a useful log is not evidence that the key was never accessed. GitHub’s incident-investigation guidance covers assessing exposure and investigating potential impact.
Free tools Windows power users keep installed
One-click scans. No signup required.
Decide whether to remove the secret from Git history
After the credential is invalidated, decide whether removing it from history is warranted. Rewriting history can reduce further exposure through the central repository, but it requires coordination and can disrupt collaborators’ branches and clones. Existing clones may retain old commits and the secret; changing the hosted repository does not erase every copy.
If you rewrite history, plan the procedure with repository owners, communicate the synchronization steps to collaborators, and account for copies and forks that may be outside your control. GitHub describes the implications and coordination considerations in its sensitive-data removal guidance. History cleanup is not a substitute for rotating the credential.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prevent the next accidental commit
Use more than one checkpoint when practical: a local scan catches issues before commit, CI can check changes during development, and host-side protection can act when a push is attempted. Their exact coverage and availability depend on the tools and repository host you use.
Rank #4
- Local scanning: Add a pre-commit check or run a scanner as part of the development workflow. Gitleaks documents local and repository scanning in its project documentation.
- CI scanning: Scan proposed changes in your build or review pipeline so findings can be handled before merge. Confirm that alerts do not print full secret values into logs.
- Host-side push protection: Enable it where available. GitHub documents push protection as a control that can block pushes containing detected secrets; see GitHub’s prevention guidance.
Choose controls based on scan scope, detection patterns (including any custom patterns your tool supports), alert handling, and access requirements. The cited documentation establishes these examples but does not provide a current cross-provider comparison of plans or prices; check the relevant provider’s current terms before relying on a feature.
Quick Recap
Best Value
- Used Book in Good Condition
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
