I accidentally committed a password/API key to GitHub — what now?

Question

I pushed a `.env` file with our database password and a payment API key to a public repo 10 minutes ago. I deleted the file in a new commit. Am I safe?

Accepted Answer

**No.** Deleting it in a new commit leaves it in the history, and bots scan public GitHub for secrets within **seconds**. Treat the secrets as compromised:

1. **Rotate/revoke every secret immediately**: new DB password, new API keys, and revoke the old ones at the provider. This is the step that actually protects you.
2. **Check for abuse**: provider logs, billing, database access logs.
3. **Then** clean the history, so the leak doesn't linger:
```bash
# with git-filter-repo (recommended over filter-branch)
git filter-repo --path .env --invert-paths
git push --force --all
```
   Forks and caches may still have it, which is why rotation (step 1) matters most.
4. **Prevent it next time**:
   - add `.env` to `.gitignore` and commit a `.env.example` instead;
   - enable **GitHub secret scanning and push protection** on the repo;
   - add a pre-commit hook such as `gitleaks`.

2 Answers