Rotate first, then rewrite history. Deleting the file does nothing
A commit that removes a secret leaves it in every prior commit, every clone, every fork, and GitHub's cached views of deleted forks. A leaked key on GitHub or Docker Hub is tried within minutes. 64 percent of valid secrets leaked in 2022 were still valid in January 2026.
Where it bit
A personal phone number in commented-out JSX in the portfolio, in history forever. TruffleHog pulled 40 valid keys out of deleted forks in one study.
The practice
Rotate the credential first, because the scrub is cosmetic until you do. Then git filter-repo --sensitive-data-removal, force push, and a support ticket for cached views. Push protection on every public repo so it cannot happen again.
Check it
git log -p -S "sk_live_" --all | head
git log -p --all -G "[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}" | grep -cE "^\+"Get this check as a script you can run tonight
What to do with this
If you run a business on something AI built and the checks came back with more than you expected, that is worth a conversation.
We do a free 30-minute Health Check for service businesses that want to know exactly where their biggest leaks are. No slide deck. No pitch. We ask questions, find the gaps, and tell you what we see. If there is no obvious fix, we will tell you that too.
Blinkz finds what is broken in how a business runs, then fixes it. AI only where it earns its place.