Sensitive data slipping into version control is not rare. It’s common. It happens when a developer commits a file with an API key, password, or personal record. Later, someone needs to recover a past version, and git checkout quietly pulls it back into the working tree. What looked harmless becomes a security incident waiting to happen.
Git is powerful because it remembers everything. But this is also its danger: once a secret is in the history, it’s there unless you rewrite it away. Even if you delete the file in a later commit, git checkout can revive it in seconds. This is why cleaning a repository matters as much as writing clean code.
Finding leaked secrets is step one. Tools like git log, git grep, and specialized scanners can hunt for patterns over the entire commit history. Step two is removing them completely. That means rewriting history using commands like git filter-repo or BFG Repo-Cleaner to strip sensitive blobs from every commit. It’s tedious work. It’s easy to get wrong. And in large repositories, it’s slow.