Never commit credentials
Passwords, API keys, private keys, cloud credentials and production secrets should not be committed to Git. A private repository is not a safe substitute for secret management because access can expand and history is persistent.
What to do if a secret is committed
First revoke or rotate the exposed credential. Removing the file in a new commit does not remove it from older history. If the secret is sensitive, history may also need to be rewritten and all affected clones and caches considered.
Prevent repeats
Use environment-based configuration, secret managers, repository scanning and pre-commit or CI checks. Teach the team what information is considered a secret and how to store it safely.
ADVERTISEMENT