Purge a committed secret

A secret committed three commits ago is in three trees, and anybody who cloned the repository has all of them. Removing the file in a new commit changes nothing about that.

The fix is to rewrite every commit that contained it, which changes every id from that point forward — so it is disruptive, and everyone else has to reset onto the new history.

Read the flags carefully. git filter-repo --path .env keeps .env and discards everything else; removing it is --path .env --invert-paths. Getting that backwards on a real repository is its own kind of disaster.

Rotate the credential regardless. Assume anything that reached a shared remote is public, because the old objects survive in every clone until each one is pruned.