Purge a committed secret
Deleting it in a new commit leaves it in every earlier one.
A secret committed three commits ago is in three trees, and anybody who cloned the repository has all of them. Removing the file in a new commit changes nothing about that.
The fix is to rewrite every commit that contained it, which changes every id from that point forward — so it is disruptive, and everyone else has to reset onto the new history.
Rotate the credential regardless. Assume anything that reached a shared remote is public, because the old objects survive in every clone until each one is pruned.
Commands in this lesson
git filter-branch- Rewrite every commit, for example to remove a file from all of history