We removed secrets from our repo 6 months ago. Turns out they’re still recoverable in git history.
Found out the hard way that deleting a secret from code doesn’t delete it from git history. Anyone with repo access can run a few commands and recover every credential we ever committed. We thought we fixed this months ago, well we didnt.
Apparently it’s a common thing, secrets that look removed but are sitting right there in commit history, valid and active.
What are ppl using that scans git history and validates whether discovered secrets are still active across cloud envs? Need something that tells me this AWS key from 6 months ago still works and has access to prod.
u/Exciting_Fly_2211 — 24 hours ago