Question 1

Why is committing a secret so dangerous even if I delete it later?

Accepted Answer

Git history is permanent by default. Once a secret is pushed, it lives in the commit graph, in every clone, and often in CI logs and forks — deleting the line in a later commit does not remove it from history. The only safe response is to treat the secret as compromised and rotate it immediately, then purge history if needed.

Question 2

How do automated secret scanners find these?

Accepted Answer

Tools like gitleaks, trufflehog, and GitHub secret scanning match high-entropy strings and provider-specific patterns (for example AWS keys start with AKIA, GitHub tokens with ghp_, Stripe live keys with sk_live_). Running a scanner as a pre-commit hook and in CI stops most leaks before they are pushed.

Question 3

What should I do instead of hardcoding secrets?

Accepted Answer

Load secrets from environment variables or a secrets manager (Vault, AWS Secrets Manager, Doppler) at runtime, keep them out of the repo with .gitignore, and commit only a .env.example with placeholder values. Config that is not sensitive — region names, bucket names, feature flags — is fine to commit.

Git Secret Scanner

How to play

Frequently Asked Questions