🔐 How to Remove a Leaked .env File from GitHub Using BFG Repo-Cleaner

Accidentally committing a .env file to a GitHub repository can expose sensitive secrets like API keys, database credentials, and private tokens. Even if you delete the file in a later commit, it remains in your Git history unless explicitly removed.

In this guide, we’ll walk through how to permanently remove a .env file from your Git repository, using BFG Repo-Cleaner, a high-speed alternative to git filter-branch.

🚨 Step 1: Revoke the Exposed Secrets

Before anything else, go to each service (e.g., Supabase, Firebase, AWS) and revoke or rotate the exposed keys immediately. Once a secret is exposed publicly, it’s no longer secure — even if removed later.

🧼 Step 2: Manually Remove .env from the Latest Commit

BFG does not remove files from commits that are still referenced (like main, HEAD, or other branches). You must manually delete the file before cleaning your history.

Remove the file from Git (but not your disk):

git rm --cached .env
git commit -m "Remove .env file from repository"

Then optionally:

echo ".env" >> .gitignore
git add .gitignore
git commit -m "Ignore .env file going forward"

🧹 Step 3: Use BFG Repo-Cleaner to Wipe It from Git History