No. Yanking removes a version from RubyGems.org, but a pushed gem is public and widely mirrored, so you should treat any secret in it as exposed. The RubyGems guidance is to revoke the secret first, then yank the version.
What yanking does
The RubyGems guide says gem yank removes your gem from being available with install and the other gem commands, and that it also removes the gem file, as of April 20, 2015. It then warns that a webhook and mirror system pings several hundred services when new gems are pushed, so you should immediately reset any passwords or sensitive data you pushed, even if you yank right away.
Order of operations
| Step | Why |
|---|---|
| 1. Revoke or rotate the secret | It may already be copied |
| 2. Yank the affected versions | Stop new installs |
| 3. Check usage logs for the secret | Find out if it was used |
| 4. Publish a clean version | Give users a safe upgrade |
| 5. Tell affected users | They may have the old version locked |
The security guide states the same order: if a secret does ship, revoke it first, then yank the version. It also says a leaked API key or password cannot be recalled by yanking.
How secrets end up in a gem
Most leaks come from a broad file list in the gemspec. A glob can sweep up local configuration, environment files or test credentials. The guide recommends building the files list from an explicit allowlist such as git ls-files, and reviewing the packaged files before pushing.
A pre push check
- Build the gem locally.
- Unpack it and list the contents.
- Search the contents for keys, tokens and environment files.
- Confirm the files list comes from version control, not a wildcard.
- Only then push.
gem build mygem.gemspec
gem unpack mygem-1.0.0.gem --target=/tmp/check
grep -rniE "api_key|secret|token|password" /tmp/check
What consumers should know
If a gem you use yanked a version, your Gemfile.lock may still reference it. Bundler will complain at the next resolve. Check the gem's advisory or release notes to see whether a secret was involved, and move to the clean version.
Try it yourself
Click through it at your own pace, or open it full screen. See how a scan flags hard coded credentials before they ship.
Where Safeguard fits
Safeguard's reachability analysis helps separate advisories your code can reach from those it cannot. You can try a free scan on your own lock file.
Quick check
Should I yank before revoking?
No. Revoke first. Yanking does not recall copies that mirrors or services already hold.
Does a yanked version still work for existing users?
Existing installs keep running, but new installs cannot fetch it, so locked projects will need to move to another version.
Sources
Last reviewed: 19 October 2026.
