Secret scanning and leaked credentials

Secrets can survive in Git history

Deleting a secret from the current branch does not necessarily remove it from older commits. If a credential is exposed, the first response should be to revoke or rotate it.

Prevention is better

Use repository scanning features where available, local checks and secure secret-management practices. Keep environment-specific credentials outside source control.

History cleanup is a separate operation

After revocation, sensitive history may need rewriting depending on the situation. History rewriting can affect every clone, fork or cached copy, so coordinate carefully.