The vault key in the old filing cabinet
Watch it happen
A vault key is committed, then deleted from the current code. Mallory finds it in old history and the unchanged lock still opens.
Alice walks in with the bank’s vault key (an API key, a database URL, a service-role key) for the teller to use.
In bank terms and app terms
| In the bank | In your app |
|---|---|
Are you exposed?
A .env, .pem or credentials file was ever committed, even if you deleted it afterwards. You pasted a key into code “temporarily” (Stripe, OpenAI, AWS, Supabase service role) and later removed it. Your repo is public, or has been shared with contractors or CI tools you do not fully control.
Revoke and rotate any secret that was ever committed. Deleting it from code is not enough. Keep secrets in environment variables or a secret manager, and add .env* to .gitignore. Add a pre-commit or CI secret scanner (for example gitleaks), and optionally purge history with git filter-repo after rotating (rewriting history alone is not enough once pushed, since forks and clones keep copies).
It has happened to real companies
Uber (2016) — Intruders used an access key that an Uber engineer had posted on a code-sharing website to reach Uber's cloud storage; Uber said about 57 million users' data was accessed. Uber paid the intruders $100,000 through its bug bounty program and did not disclose the breach until November 2017.
Samsung (2019) — A security researcher found that Samsung's SmartThings developers had left source code, secret keys and AWS credentials in publicly accessible GitLab projects.
What it looks like in code
// BAD: Hardcoded secret in source code
const STRIPE_SECRET = "sk_live_51abc123def456..."
// BAD: Committed .env file
// .env
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIs...
DATABASE_URL=postgresql://user:p@ssw0rd@db.example.com/prod
// BAD: "Removed" secret (still in git history)
// git log shows: commit abc123 "add config" → commit def456 "remove secrets"
// The secret is still accessible via: git show abc123:.env
Ask your AI tool to fix it
Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.
Check my repo and its git history for committed secrets (.env files, API keys, tokens, database URLs, private keys). List what you find and which provider each belongs to so I can rotate it. Then move all secrets to environment variables, add .env* to .gitignore, provide an .env.example with placeholder values, and add a gitleaks pre-commit hook.Where this comes from
The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.
- Removing sensitive data from a repositoryGitHub DocsHistory rewriting with git filter-repo; forks and clones keep copies, so rotate the secret
- Secrets Management Cheat SheetOWASPKeep secrets out of source control, rotate them, and use a secret manager or environment
- About secret scanningGitHub DocsScanners find committed secrets, including in history, and push protection blocks new ones
- gitleaks: find secrets in git reposGitHubOpen-source secret scanner usable as a pre-commit hook or in CI
- git-filter-repoGitHubTool for purging files and strings from repository history
- Uber: Hackers stole 57m passengers, drivers' info. We also bribed the thieves $100kThe RegisterUber 2016: keys from a GitHub repo reached AWS data; 57 million users; $100,000 paid as bounty
- Samsung spilled SmartThings app source code and secret keysTechCrunchSamsung SmartThings source code, secret keys and AWS credentials in public GitLab projects
Spot a mistake or something out of date? Report a correction · How these guides are made and checked
The free, open-source scanner checks for most of the problems in these guides.