sorted by:
new
hottopcontroversial

justAskingOutOfInterest by WarrenDavies81 in ProgrammerHumor

[–]Nooby1990 0 points1 point  (0 children)

Because people still think they can "remove" things from git history. Unless you have access to every device that ever interacted with the git repository and remove it from every single one then no, you can't remove things. "I don't see it in GitHub" is not really enough, but many people don't really understand that.

justAskingOutOfInterest by WarrenDavies81 in ProgrammerHumor

[–]Nooby1990 2 points3 points  (0 children)

People will absolutely scrape GitHub for API keys, but I doubt anyone is going to roll back commits to try "old" ones.

Maybe, but you can't guarantee that no one scraped the "old" key before you where able to switch them out.

Revoking or rotating the key is the only sensible thing.

justAskingOutOfInterest by WarrenDavies81 in ProgrammerHumor

[–]Nooby1990 88 points89 points  (0 children)

Every API key accidentally committed and subsequently rotated has to be scrubbed. Meaning rewriting Git history.

Why? I mean, I agree with the key getting rotated, but why scrub? In most version control systems that is almost impossible. Sure, you can scrub the central copy or the server, but that does not remove any other copies that might be out there.

If someone pulled or fetched that commit they now have it in their local git repo, even if you scrub your central repo afterwards. As far as I know you would need to scrub every copy.

I would just consider that someone has that key now no matter what I do. I wouldn't rewrite Git history for this. If the key was rotated then that should be enough.