What to do when you find a secret in a repo

Treat any committed credential as compromised the moment it lands in version control — even in a private repository, even if you catch it quickly. You generally can’t know for certain who already has a copy: anyone with prior clone access, a CI system that checked it out, or a fork made before you noticed. Rotating the credential (issuing a new one and invalidating the old) is the only step that actually closes the exposure. Everything else is cleanup that matters for hygiene, but doesn’t undo the leak on its own.

Deleting the file in a new commit leaves the secret sitting in every earlier commit’s history — trivially recoverable with git log -por by checking out an old revision. Rewriting history (an interactive rebase, or a tool built for this) can remove it from the repository’s own history going forward, but it does nothing about copies that already exist elsewhere: clones, forks, CI logs, cached build artifacts, or anyone who already pulled before the rewrite. History rewriting is worth doing for hygiene and to stop the leak from being trivially rediscoverable later — it is not a substitute for rotation.

No single detection method catches everything. Fixed-shape pattern matching (an AWS access key’s AKIA prefix, a GitHub token’s ghp_ prefix) is precise but only works for credential formats with a recognizable shape. Contextual detection — flagging a generic-looking value sitting next to a key name like password or secret— catches values with no distinctive shape of their own. Entropy-based detection, which flags long, high-randomness strings regardless of context, is the broadest net and the noisiest — it’s a reasonable catch-all for otherwise-unrecognized formats but produces the most false positives, which is why it should carry the lowest confidence of the three. Combining all three, as opposed to relying on just one, is what makes automated scanning useful without being either blind to novel formats or overwhelmed with noise.

Scan pasted text for likely secrets with the Secret Scanner (runs entirely in your browser by default), or scan a .env file specifically — including public-variable exposure and weak-default checks — with the .env Security Scanner.