iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Rotate or revoke the exposed credential first. Then use git-filter-repo to rewrite every affected commit, branch, tag, and path, force-push the cleaned references, coordinate with everyone who has a clone or fork, and request host-side removal of cached pull-request or web views. Deleting a file in a later commit does not erase earlier objects, and rewriting history cannot invalidate a password or token that someone already copied.
Why deleting the file is not enough
Git stores snapshots in a commit graph. A deletion commit changes the latest snapshot, but earlier commits still contain the original file or text. Anyone who can reach those commits through another branch, tag, pull-request reference, clone, fork, cache, or backup may still retrieve it.
That is why an exposed password, API key, private key, session token, or other credential must be treated as compromised as soon as it reaches a remote. History cleanup reduces future exposure; it does not undo a copy already made by an attacker, a build system, a mirror, or a collaborator.
GitHub Docs states that when the sensitive data is a secret, the first step is to revoke and/or rotate it.
#1 Best Overall
Sale
Password Book with Alphabetical Tabs, Password Keeper for Seniors 5.3"x7.7"
- 【Featured A-Z Tabs & Untitle for Security】Our password books have recognizable alphabetical tabs with the colorful design allow you to locate quickly and save time. The anonymous cover of our password keeper is unobtrusive and stays secure.
- 【Premium Quality & Perfect Size】This password journal features a eco-leather hardcover and 100gsm no-bleed paper, equipped with an elastic band, inner pocket, pen loop and bookmark. It comes in medium format (5.3 x 7.7 inches) which is the perfect size you need.
- 【Clean Layout & Plenty of Space】 Each tab has 6 pages with 4 entries per page and contains more than 552 passwords in our password organizer. This password notebook also provides more password space in case you need to change your password.
- 【Perfect Organization & Safe Placement】We ensure this password log book provides you with a secure space to keep passwords and web addresses. You won't have to worry about passwords being leaked or hacked.
- 【Thoughtful Gift & Warm Heart】 Considering for practical gifts for family or friends? Our specially designed internet password book is sturdy and easy to use. Ideal for any occasion, it's a gift that truly shows care.
Personal data needs the same careful inventory. Examples can include an email address, phone number, identity document, customer export, or other identifying string embedded in a source file, fixture, test artifact, or documentation. A whole-file removal is safest when the file has no required content. Targeted replacement is appropriate when useful code or documentation must remain.
Use this response order
- Contain: revoke passwords and tokens, disable exposed accounts, and rotate API keys and private keys with the issuing provider.
- Record safely: create an incident record containing repository, ref, and timing details, but never paste the secret into a ticket, chat, issue, or commit.
- Prepare: notify collaborators, pause normal writes, and make a disposable fresh clone for the rewrite.
- Inventory: identify every branch, tag, pull-request ref, moved or renamed path, and string variant that may contain the data.
- Rewrite: remove whole files with a path filter or replace known text while retaining needed files.
- Review: search all rewritten refs, inspect filter-repo reports, and confirm required code remains.
- Publish: force-push the rewritten refs, subject to branch-protection controls.
- Coordinate copies: have collaborators delete or reclone old copies and rebase work made from tainted history.
- Clean hosted remnants: ask the hosting provider to address cached views and pull-request references where its process allows.
- Prevent recurrence: move secrets out of Git, add scanning and ignore rules, and document rotation steps.
Containment: rotate or revoke before rewriting
Credentials issued by a provider
Use the issuer’s control panel or administrative API to revoke the exposed token, disable the password, or rotate the API key. Generate a replacement and update every service that legitimately uses it. For private keys, replace the key pair and remove trust in the old public key wherever it was authorized.
Do not wait for the history rewrite to finish. A forced push can take time, and old objects may remain in clones, forks, caches, pull-request references, or backups. Rotation is the action that makes the credential itself unusable; rewriting addresses where the data is stored.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesPersonal data without a revocable credential
Some personal data cannot be revoked like a token. Limit further exposure by removing or replacing it in every affected ref, then follow the hosting provider’s process for cached pages, pull requests, and other copies. Record what was removed and which references were checked without reproducing the data in the incident record.
Preserve evidence without spreading the secret
Keep the minimum incident details needed for response: repository name, affected paths or commit identifiers, discovery time, issuer, rotation time, and people responsible. Store evidence in an access-controlled system. Do not include the literal password, token, or personal-data value in ordinary tickets, chat messages, screenshots, or new commits.
Prepare a safe rewrite
Use a disposable fresh clone
Start from a new clone rather than an everyday working directory. A clean clone reduces the chance that stale refs, uncommitted files, or local automation will reintroduce the removed object. Keep the working copy available until validation and publication are complete, but treat the old clone as tainted.
Pause writes and notify the team
Tell contributors when the rewrite will happen and temporarily pause merges and automated jobs that push to the repository. Any commit created from the old graph can reintroduce the sensitive object or create confusing divergence while the cleanup is in progress.
Rank #2
- 【Tired of constantly searching for or resetting your passwords?】 MOSA BEAR password keeper book is the perfect solution for you! This password book provides a dedicated place to securely store all your important website addresses, emails, usernames and passwords, ensuring your information is protected and easy to find. The well-designed log pages help you manage multiple accounts in a systematic way, saying goodbye to password confusion.
- 【Premium Design & Password Security】 The password book with alphabetical tabs features an anonymous cover design with no title on the cover, effectively avoiding information exposure. The password keeper design is specifically designed with password security in mind, providing space to record password hints instead of writing directly on the password itself, further protecting your important information.
- 【Simple Layout and Plenty of Space】The 160-page password logbook is designed to provide ample space to record passwords and other important information. It can store up to 414 passwords. In addition, it provides extra pages to record other information, such as email setup, card information, computer operating system information, software licenses, and more. The journal also includes 3 blank pages at the end for you to add additional notes.
- 【Palm-sized Size & Premium Quality】 This password notebook has an ideal size, 4.3" x 5.7", for carrying around, whether in a purse or pocket. Its sturdy glue binding allows the notebook to unfold smoothly and is more comfortable to use. The inner pages are made of high-quality 100GSM thick paper, which can effectively reduce ink penetration and ensure a cleaner and neater writing effect. The overall design takes into account both portability and durability, making it an ideal choice for recording important passwords.
- 【A-Z Tabs for Quick Search 】Our password book comes with alphabetical tabs to help you find the password you need quickly and easily. Alphabetically organized tabs ensure that you can quickly flip to the right section, saving you the time and hassle of searching for your password.
Inventory every place the data can exist
- All local and remote branches, including branches not currently checked out.
- Annotated and lightweight tags, release refs, and deployment refs.
- Pull-request refs maintained by the hosting service.
- Old and new names if a file was moved or renamed.
- String variants such as different capitalization, escaped forms, copied configuration values, and the same personal-data value in fixtures or documentation.
- Large-file-storage objects or reports that may be detached after rewriting.
Write the inventory down before filtering. A path that was renamed requires both the old and new path to be considered; removing only the current name can leave the earlier copy in history.
Choose the appropriate cleanup method
| Decision | Use when | Important consequence |
|---|---|---|
| Whole-file path deletion | The entire file is sensitive and no useful content must remain. | Every historical version of the selected path is removed; include prior names after a rename. |
| Targeted text replacement | A known password, key, identifier, or personal-data string appears inside files that must be retained. | Only matching text is replaced; every known variant must be listed or a copy may remain. |
| All-reference rewrite | The objective is repository-wide removal. | Branches, tags, and other refs receive new commit IDs and require coordinated force-pushes. |
| Limited-reference rewrite | A narrowly scoped ref is intentionally being repaired and the scope is documented. | Unfiltered refs can still expose the data and can reintroduce it later. |
| Local rewrite | You need to transform the Git object graph. | It does not remove hosted caches, pull-request refs, forks, or other clones by itself. |
| Hosted-service cleanup | Old web views, pull requests, or cached objects remain after the push. | The provider may require specific evidence and may not control forks or private clones. |
git-filter-repo is the current GitHub-documented default for this work. BFG is a documented alternative for file deletion or password replacement, but its guidance is older and it does not remove the need for rotation, coordination, and hosted cleanup.
Rewrite a sensitive file with git-filter-repo
Run the command from the disposable clone after confirming the path inventory. Replace the example path with the repository-relative path of the file.
- Open the disposable clone and verify that no unrelated work is present.
- Run
git-filter-repo --sensitive-data-removal --invert-paths --path PATH-TO-FILE. - If the file existed under an earlier name, include that old path in the rewrite plan and remove each affected name.
- Review the filter-repo reports and note the first commits changed and any orphaned large-file-storage report.
The --invert-paths form means the selected path is excluded from every rewritten snapshot. It is appropriate for a file that should not exist anywhere in history. Do not use it for a file whose non-sensitive contents must be preserved; use targeted replacement instead.
Replace known strings while keeping the file
Create a replacement file outside the repository. Put each known sensitive value and its intended replacement in the format supported by your installed git-filter-repo version, then run:
git-filter-repo --sensitive-data-removal --replace-text ../passwords.txt
Keep the replacement file outside the repository so it cannot itself be committed. Include every representation you found: the original value, copied configuration forms, escaped values, and values that appeared before or after a file rename. Replace a secret with a neutral marker or other non-sensitive value that will not be mistaken for a working credential.
Rank #3
- Never Forget a Password Again - Always forget your password? Taja password keeper book provides an opportunity to create secure passwords and store them safely in one place, where no hacker can reach. Now, you won't have to fry your brain in search of that password.
- Easy-to-Find Passwords - Our password book with alphabetical tabs helps you quickly and easily find the password you need. With the alphabetically organized tabs, you can easily flip to the right section, saving you time and hassle searching for passwords.
- Plenty of Room To Write - This 136-page password logbook provides ample space to record your passwords and other important information. It can store up to 480 passwords, as well as details for one wireless router and your internet service provider. In addition, you can record up to four email accounts, eight software licenses, and eleven crucial websites. Finally, the logbook includes four pages for additional notes.
- Premium Design - This password keeper has been designed to be anonymous without an obvious title on the cover with an elastic band, 1 pen holder, 2 bookmark, 1 inner pocket at the end of the logbook and thick no-bleed 100gsm paper.
- Great Present for Everyone - Need a practical present for seniors? Our password notebook for seniors is designed for them with a 5.2" x 6.8" size and durability. Keep all passwords organized and easily accessible without digital storage. It's a thoughtful present for any occasion that shows you care about their security and convenience.
Targeted replacement is useful for a source file, documentation page, test fixture, or configuration template that must remain. It is also the safer choice when a file contains both personal data and required code. Review the resulting files for accidental changes to syntax, tests, examples, and documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review the rewritten graph before publishing
Check every ref, not just the default branch
Search all rewritten refs for the sensitive path and known strings. Inspect branches and tags that are not part of the normal checkout, and account for pull-request refs maintained by the host. A clean default branch does not prove that every reachable ref is clean.
Use filter-repo reports
Read the reports produced by git-filter-repo. Confirm which commits were first changed, which paths were affected, and whether the tool identified orphaned large-file-storage objects. Save those details for the hosted-support request and the incident record.
Confirm that required content survived
- Build or test the code that should remain.
- Open representative documentation, fixtures, and configuration templates.
- Check that only the intended file or text changed.
- Verify that replacement markers are not valid credentials.
- Count affected pull requests before making the rewrite irreversible.
Do not publish merely because a local search looks clean. The review must cover the complete ref inventory and the application content that the rewrite was meant to preserve.
Publish the rewritten history
When review is complete, push the rewritten refs with:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →git push --force --mirror origin
This updates the mirror of the local refs at the remote and changes commit IDs throughout the rewritten graph. Branch-protection controls may reject the operation; an administrator may need to adjust those controls for the maintenance window and restore them afterward.
Pull-request refs often need separate handling by the hosting service. A successful mirror push does not guarantee that an old pull request, cached comparison, or web view has been purged.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
Coordinate collaborators, forks, and other clones
Why merging old work is dangerous
Every commit created from the old graph is a potential route for the removed data to return. A merge can reconnect tainted commits even when the destination branch looks clean. GitHub Docs specifically instructs collaborators to rebase, not merge, branches created from the old history.
Recommended contributor procedure
- Stop pushing from the old clone and save any uncommitted work without copying the secret into a new file.
- Delete the old clone or keep it isolated and clearly marked as tainted.
- Clone the rewritten repository again.
- Reapply legitimate local work onto the rewritten tip by rebasing or by carefully recreating the changes.
- Run the same checks used by the incident owner before pushing.
Fork owners and people who made independent clones must remediate their own copies. The repository owner cannot force a private clone, offline backup, or independently hosted mirror to forget an object.
Recommended Free Tools
Signatures and commit IDs
Rewriting changes commit IDs. Existing commit signatures can become invalid because the signed commit object no longer exists in the same form. Contributors should expect to recreate signatures and review any process that relies on immutable commit identifiers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Request hosted-service cleanup
After the force-push, contact GitHub Support when old sensitive material remains in cached views or pull-request references. Include the repository, affected pull-request numbers, the first-changed commits reported by git-filter-repo, and any orphaned large-file-storage report. Support may purge cached views and sensitive pull-request references when its criteria are met.
Support cleanup is not a substitute for the local rewrite. It addresses hosted remnants that the Git object rewrite cannot reach. It also does not clean forks or other owners’ clones, so those owners must complete their own remediation.
If you only rewrite history and force-push it, commits with sensitive data may still be accessible elsewhere.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Prevent another exposure
Keep secrets out of tracked files
Load credentials from environment variables or a dedicated secret-management service at runtime. Commit a non-sensitive configuration template that documents required variable names, not working values. Add local secret-file patterns to .gitignore so ordinary development files are not staged accidentally.
Best Value
- Never Forget Passwords Again: Record 468 passwords, with space for updates; Say goodbye to password woes! Secure Pass Keeper Book keeps you covered
- Secure Your Secrets: Discreet appearance, pocket-sized convenience; The ultimate keeper of privacy in your hands, sized at 4.1''x 5.8''
- Master your passwords with Alphabetical Tabs: 24 sections, each storing up to 18 passwords; Ample writing space to update and secure passwords; Add personal hints and notes for extra security; # Index tabs for frequently used passwords; Plus, lined note pages for convenient note-taking
- Enduring Vegan Leather: Exquisite Texture; 100 GSM Paper Resists Ink Bleed-through, Ensuring Long-lasting Value; Elevate Your Password Management
- Added Functionality: Sturdy Pen Loop, Elastic Band and Inner Pocket; Enjoy 180° Lay Flat for effortless writing, 360° Flipping for comfortable reading from any angle with spiral binding; A practical gift for family, friends, and partners
Add detection before and after push
Enable secret scanning where your hosting service or security tooling provides it. Run checks in development and continuous integration, and make the failure actionable: identify the file and line, explain how to rotate the credential, and prevent the job from printing the value in logs.
Document a rotation runbook
Record who can revoke each credential, where replacements are created, which deployments consume them, how to confirm the old value is disabled, and who owns the Git-history response. Include the command forms, ref inventory, collaborator notice, support request, and validation checks described above.
Troubleshooting common failures
The secret still appears in a web page
Check whether the page is a cached view, a pull-request ref, a tag, or an unfiltered branch. Verify the local rewrite across all refs, then send the hosting-support request with the repository, pull-request numbers, first-changed commits, and any large-file-storage report.
The force-push is rejected
Branch protection or an administrative policy may block mirror pushes. Coordinate an authorized maintenance window, obtain the required administrator action, and ensure no new writes occur during the rewrite. Do not work around the control by pushing only the default branch while leaving exposed tags or other refs untouched.
A collaborator reintroduced the old commit
Stop the push, identify the tainted branch or clone, and have the contributor reclone or rebase from the rewritten history. Do not merge the branch into the cleaned repository. Repeat validation before publishing again.
Only the renamed path was removed
Inspect the path history and add every earlier name to the rewrite plan. A rename changes the path string; it does not remove the file’s earlier snapshots.
Builds or signatures fail after cleanup
Review the rewritten files for unintended replacements and update systems that stored old commit IDs. Recreate invalidated signatures where required, and rebase legitimate work onto the new graph rather than merging branches based on old commits.
Free tools Windows power users keep installed
One-click scans. No signup required.
The credential was rotated but scans still find the old text
Rotation disables the credential but does not erase its historical string. Complete the rewrite, inspect all refs and variants, and request hosted cleanup for remaining cached or pull-request views.
Quick Recap
Final operational checklist
- Credential revoked or rotated with the issuer.
- Incident record created without the secret or personal-data value.
- Collaborators notified and writes paused.
- Disposable fresh clone prepared.
- Branches, tags, pull-request refs, renamed paths, and string variants inventoried.
git-filter-reporun with the correct file-path or replacement strategy.- All refs and filter-repo reports reviewed.
- Required code, tests, and documentation checked.
- Rewritten refs force-pushed with appropriate administrative controls.
- Collaborators and fork owners instructed to reclone or rebase, never merge tainted work.
- Hosted-support request submitted with affected pull requests and first-changed commits when needed.
- Environment variables or a secret manager, ignore rules, scanning, and a rotation runbook put in place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
