Protect source and CI
Keep secrets out of source
Prevent, detect, and respond to committed credentials without treating history rewriting as a substitute for revocation.
8 minute lesson
Git remembers. Once a secret enters a repository, assume every clone and automation path may have copied it.
Use local ignore rules, example files without values, secret managers, pre-commit checks, and host scanning. If a secret is committed, revoke or rotate it first, then clean history only when the exposure and coordination justify it.
A cloud key is committed, removed in the next commit, and assumed safe. A fork, CI log, or local clone may already contain it, so rewriting Git history cannot invalidate the credential.
Pre-commit detection reduces accidents but can also block harmless test strings. Pair detection with a clear revocation path and a reviewed way to handle false positives.
Commit a scanner-approved fake credential to a disposable repository and save the alert evidence. Follow the response runbook through revocation simulation, history search, and affected-system inventory. Then test a harmless look-alike value and document how a developer can resolve the false positive without disabling scanning globally.
Lesson completed