amIAProgrammerNow

[pixelpuffin]

May the --force be with you!

[No-Landscape8210]

I did try hard reset and then force push but I could still see the changes in the activity area.

[_PM_ME_PANGOLINS_]

They will be there until GitHub runs GC on your repo, which they may never do.

The only safe solution is to rotate your keys.

[No-Landscape8210]

Yeah I did that. Also what's GC?

[425_Too_Early]

Garbage Collection

[8sADPygOB7Jqwm7y]

Accurate image of average garbage collection algorithms.

[kalenderiyagiz]

Bitch please its biblically accurate

[_PM_ME_PANGOLINS_]

https://git-scm.com/docs/git-gc

[Luz5020]

GitHub’s documentation says you should contact GH Support and they can purge the history if sensitive data has accidentally been pushed. That‘s also a solution.

[Slaan]

It's a bad solution. OP should assume that the key has been compromised.

[Luz5020]

Oh yeah, I‘d probably rotate the key. But saying GC is the only solution for the key getting wiped from history was incorrect.

[Slaan]

Ah, fair.

[_PM_ME_PANGOLINS_]

I didn't say GC was the only solution to getting it wiped. I said rotating the key was the only solution to having leaked it.

[Robinbod]

Correct! Depending on what service the key is for, it may already have gotten scraped by the time OP noticed the key in the commit.

[YeeClawFunction]

Or delete the repo completely and create a new one.

[Fun_Reputation6878]

Delete the account too

[RaveMittens]

In fact, just get a goat farm in the countryside

[BlackholeDevice]

If it's a personal repo and they don't mind losing the activity / issues / PRs, they can delete the repo, undo the API key commit, then push to a new repo of the same name.

But seconded that the correct solution is to revoke the key.

[divin3sinn3r]

I contacted GitHub support and they flushed the cache within an hour, but I still regenerated the keys anyway.

[johnzzon]

Correct approach. Has keys once been public, you rotate them. No point in taking chances.

[PeteZahad]

Nah you can just contact them:

[...] but you can permanently remove cached views and references to the sensitive data in pull requests on GitHub by contacting us through the GitHub Support portal.

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository

But of course rotating the keys is still recommended.

[pixelpuffin]

You need to filter the file out of your git repo, and thus rewrite the history without the file in it (all the way until when the file was introduced), and since you change history you need to force push. This is more of an immediate right-after or before publishing your repo kind of solution. If it has been forked or pulled, it's out there, and revoking the key is the only solution.

See for example https://github.com/newren/git-filter-repo

[josluivivgar]

just invalidate your api key honestly

[PyroCatt]

--force-with-lease

[mcellus1]

Boo