Skip to content

Comment on Developer posts secret key on GitHub, loses $40K in 2 minutesparent

Comments

Then you need to read through any file in any revision. Because if you have a newer commit with the secrets removed they are still in the history.

Or `rm -rf .git && git init && git commit -m "init"` and then read through. Common to scrap previous history when you go from private -> public repository anyways, a lot in order to scrub potential things like this to leak through.

If I'm at all worried about having accidentally committed secrets in the past, I usually create a new repo for the public release with a fresh git init.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.