Git & GitHub Interview Question #130
What should you do if a secret is accidentally pushed to GitHub?
Security, Team Workflows, Troubleshooting & Senior Git/GitHub Scenarios Senior Advanced
Quick Interview Answer
Treat the exposed secret as compromised. Revoke or rotate the credential first so any copied value becomes unusable. Then remove the secret from the current project state and determine whether repository history must be rewritten according to the organization's incident process.
Detailed Explanation
Treat the exposed secret as compromised. Revoke or rotate the credential first so any copied value becomes unusable. Then remove the secret from the current project state and determine whether repository history must be rewritten according to the organization's incident process.
After remediation, inspect related logs and access where appropriate, update affected systems, and prevent recurrence with secret scanning, protected configuration, and development practices. Simply deleting the latest file does not remove a secret from older commits.
Code Example
# First: rotate/revoke the real secret outside Git.
# Stop tracking a local secret file:
git rm --cached .env
echo .env >> .gitignore
git add .gitignore
git commit -m "Remove local secret file from tracking"
# Historical cleanup is a separate operation
# and requires coordination if history is shared.