Encrypted TLS private keys and the old SNMP community are still recoverable from git history even though they are gone from the working tree:
git show 647d90a~1:certificates/Gandalf.Gondor.Lab/ca-key.pem
Requires a force-push to main, which is destructive to existing clones, so it is deliberately left for a human to run.
Runbook: docs/runbooks/purge-git-history.md
Steps
Notes
The repo had 0 forks when checked, so a purge is actually effective; no third-party copy retains the objects.
.gitleaksignore currently enumerates the known historical findings with a reason for each, which is what keeps CI green today. Removing it is the last step, not the first — it is the proof the purge worked.
Related to #9, but not blocked on it. If you only have time for one, rotate first: rotation invalidates the credential whether or not history is ever rewritten.
Encrypted TLS private keys and the old SNMP community are still recoverable from git history even though they are gone from the working tree:
Requires a force-push to
main, which is destructive to existing clones, so it is deliberately left for a human to run.Runbook:
docs/runbooks/purge-git-history.mdSteps
make purge-history-dry-run— rewrites a scratch mirror in/tmpand asserts the results; the real repo is untouchedmake purge-historyand force-pushmain.gitleaksignore; the Secret scan job should stay green on its own merits afterwardsNotes
The repo had 0 forks when checked, so a purge is actually effective; no third-party copy retains the objects.
.gitleaksignorecurrently enumerates the known historical findings with a reason for each, which is what keeps CI green today. Removing it is the last step, not the first — it is the proof the purge worked.Related to #9, but not blocked on it. If you only have time for one, rotate first: rotation invalidates the credential whether or not history is ever rewritten.