Remediation

A committed secret is compromised. Deleting it, even rewriting history, only stops further exposure; clones, forks, CI caches and scrapers may already hold it. The order matters.

1. Rotate first

secretsweep rewrite-guide FINGERPRINT prints a provider link where one is known (AWS, GitHub, Slack, Stripe, Google, OpenAI, Anthropic, npm, ...) and the generic instruction otherwise. Revoke the old credential, issue a new one, deploy it, then audit provider logs for use between the introducing commit (reported by --history) and revocation.

2. Remove from the working tree

Replace the value with an environment variable or secret manager reference and commit. scan --history shows HEAD = yes for secrets still present.

3. Purge history (optional, after rotation)

Needed when the repository is public or widely cloned and you want the value gone from the record. Use git filter-repo on a fresh mirror clone:

git clone --mirror git@example.com:org/repo.git repo-clean.git && cd repo-clean.git

# drop the file from every commit
git filter-repo --path .env --invert-paths

# or replace just the value, keeping the file
printf '%s\n' 'literal:THE-SECRET==>***REMOVED***' > ../replacements.txt
git filter-repo --replace-text ../replacements.txt

git push --force --mirror git@example.com:org/repo.git

rewrite-guide writes <THE-SECRET-VALUE> in the replacement line unless you pass --show-secrets, so the guide itself is safe to paste into a ticket.

Afterwards: every collaborator must re-clone (not pull), open pull requests may still reference old commits, and hosting providers keep unreachable objects until garbage collection; ask support to purge cached views for public leaks.

4. Verify and re-baseline

secretsweep scan --history --no-baseline
secretsweep baseline create --history     # only if remaining findings are accepted

Rewriting history changes commit hashes but not fingerprints (rule + secret + path), so existing baselines keep working for secrets you chose to keep.

5. Prevent a repeat

secretsweep install-hook for every developer and secretsweep scan --history --format sarif in CI.