Member-only story
🔐 How to Remove Secrets Accidentally Pushed to GitHub Using BFG Repo-Cleaner
Accidentally pushing sensitive information like API keys, passwords, or tokens to a GitHub repository can have serious security consequences. Even if you delete the secret in a later commit, it still lives in your Git history — and anyone can find it.
This guide walks you through how to properly remove secrets from your Git history using BFG Repo-Cleaner, a fast and straightforward alternative to Git’s built-in filter-branch.
🚨 Step 1: Revoke or Rotate the Secret
Before removing it from your repo, immediately revoke or rotate the exposed secret on the platform where it was issued (e.g., AWS, GitHub, Google Cloud). This prevents malicious use if someone has already accessed it.
🛠 Step 2: Use BFG Repo-Cleaner to Remove the Secret
BFG Repo-Cleaner is a simpler, faster replacement for git filter-branch for cleaning sensitive data out of Git repositories.
🔧 Installation
Download BFG from the official site:
👉 https://rtyley.github.io/bfg-repo-cleaner/
Make sure you have Java installed (java -version).
