How to find and remove secrets committed to a Git repository
Why it matters
An API key or password in the source is readable by everyone who can clone the repository — and, for a public one, by the bots that scan GitHub for keys within minutes of a push. Deleting the line is not enough: the value stays in history until it is rotated.
How to fix it
What to do: Move all secrets to environment variables and read them with
Add
os.environ.# BAD — secret hardcoded:
DATABASE_URL = "postgresql://user:s3cr3t@localhost/db"
SECRET_KEY = "hardcoded-key-123"
# GOOD — from environment:
import os
DATABASE_URL = os.environ["DATABASE_URL"]
SECRET_KEY = os.environ["SECRET_KEY"]
Add
.env to .gitignore and create .env.example with sample values.Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.
Related checks
- Why .env must be in .gitignore (and how to check it is not already committed)
- A .env file is committed to the repository: what to do
- Automated dependency updates with Dependabot or Renovate
- How to pin GitHub Actions to a commit SHA
- Least-privilege GITHUB_TOKEN permissions in workflows
- The pull_request_target trap in GitHub Actions