← Back to all fixes
Git

Secret accidentally committed to Git

The Issue

You committed and pushed a file containing `AWS_SECRET=AKIAIOSFODNN7...` to GitHub.

Root Cause

.env or config file was not in .gitignore and was accidentally staged and committed.

How to Fix
  1. FIRST: rotate the secret immediately — assume it is compromised
  2. Remove from history: `git filter-repo --path .env --invert-paths` (install git-filter-repo)
  3. Force push the cleaned history: `git push --force --all`
  4. Add to .gitignore: `.env`, `*.pem`, `credentials.json`
  5. Use pre-commit hooks or tools like `gitleaks` to scan for secrets before every commit
  6. If pushed to a public repo: GitHub will likely alert you via their secret scanning feature
← More fixes