$ gitpushf.uk
Git Emergency

I pushed my .env file to GitHub

Severity Critical

What just happened

Your secrets (API keys, passwords, tokens) are in the repository history. Bots scan public repositories within seconds. Removing the file in a new commit does NOT remove it from history.

Potential risks

  • Leaked keys can be abused immediately (cloud bills, data theft).
  • Forks and clones keep a copy even after you clean history.

Before you run anything

  • STEP ZERO: revoke and regenerate every secret in the file. Cleaning history is not enough.
  • Check your providers' logs for suspicious use.
  • History rewriting requires a backup clone and the team's agreement.
  • Golden rule: before any destructive command, create a safety branch with git branch backup/before-fix — it costs nothing.

Recovery steps

  1. 1

    Stop tracking the file

    Removes .env from the index but keeps it on your disk, then prevents it from coming back.

    Safe
    $ git rm --cached .env
    $ echo ".env" >> .gitignore
    $ git commit -m "chore: stop tracking .env"
  2. 2

    Make a backup clone

    A mirror clone, just in case the next step goes wrong.

    Safe
    $ git clone --mirror git@github.com:OWNER/REPO.git backup-repo.git
  3. 3

    Erase the file from all history

    git filter-repo (to install separately) rewrites every commit and all hashes change. It also removes the “origin” remote: add it back before pushing (git remote add origin <url>).

    Destructive
    $ git filter-repo --force --invert-paths --path .env
  4. 4

    Force push the cleaned history

    Everyone must then re-clone. On GitHub, also contact support to purge cached views and pull request refs.

    Destructive
    $ git push --force --all origin
    $ git push --force --tags origin

These procedures are provided for information only. Read each command and adapt it to your situation before running it. Disclaimer

Other disasters

🪓 I deleted my branch🚨 I pushed directly to main💥 I ran git reset --hard🧨 I overwrote a colleague's commits🔀 I made a bad merge👻 I lost uncommitted changes🎯 I committed on the wrong branch🎈 I'm in “detached HEAD” state⚔️ I'm stuck in a merge conflict🚫 My push is rejected (non-fast-forward)🌀 My rebase went wrong🐘 GitHub rejects a file over 100 MB🥸 I committed with the wrong name or email🗑️ I deleted a file and committed it⏪ I want to undo my last commit✏️ I amended a commit that was already pushed🧹 Too many messy commits to clean up📮 I pushed to the wrong branch🧭 I rebased onto the wrong branch🔁 I need back the changes I reverted📦 git stash pop gave me a conflict🙈 I committed a file that should be ignored🔠 Git doesn't see my file rename (upper/lower case)🧨 I ran git clean -fd by mistake🩻 My repository is corrupted🙃 I forgot to pull before pushing👯 Duplicated lines of code after a merge➖ I added a file I didn't want to (git add)✏️ I made a typo in a commit message✂️ My commit does too many things🧺 I lost a stash (drop, clear or pop gone wrong)🫥 I pulled and my code disappeared🍒 I cherry-picked the wrong commit☁️ I deleted a branch on GitHub / GitLab👥 I pushed with the wrong GitHub account🚚 The repository was renamed or moved🏷️ I tagged the wrong commit🌊 Git says every file is modified, but I changed nothing📦 I committed node_modules (or a build folder)📂 I ran git init in the wrong folder🧨 My pull request has conflicts⏳ My pull request is behind main📝 I have to apply review changes to my PR🧳 My PR shows commits that aren't mine🎯 I opened my PR against the wrong branch🚨 A merged PR broke main🚪 I closed my PR (or deleted its branch) by mistake🔴 The checks of my PR are failing🐘 My PR is too big to review🍴 My fork is behind the original repository