To scan git history for secrets, run a secret scanner over every commit on every branch, not only the checked out files, then revoke each credential it finds. A scan of current files misses anything that was committed and later deleted, which is common.
Why history matters
Git keeps every committed version of every file. If a key was added in March and removed in April, a scan of today's files sees nothing, while anyone who clones the repository can still read the March commit. OWASP warns that a secret committed to code can persist in git history even after it is removed from current files.
GitHub documents its own secret scanning as covering the full git history on all branches, and as rescanning when new secret types are added. It also covers issue and pull request text, discussions, wikis and secret gists, which a plain file scan never sees.
What to scan
| Place | Why it can hold a secret |
|---|---|
| All branches, including old ones | Stale branches keep old commits reachable |
| Tags and forks you control | Tags pin old states |
| Issue and pull request text | People paste logs and configs |
| CI logs and build artifacts | Debug output can print variables |
| Container image layers | Build steps can bake values in |
Steps
- Fetch all branches and tags so the scan has the full history.
- Run a scanner in full history mode, not diff mode.
- Sort findings into live credentials and fake or expired ones.
- Revoke and replace every live credential first. This is the step that closes the exposure.
- Decide separately whether to rewrite history. GitHub's guidance is that removing a secret from history is time intensive and often unnecessary once the credential is revoked. OWASP notes that rewriting history has side effects to weigh.
- Add a pre-commit check and a CI check so the same mistake is caught earlier next time.
Common mistakes
- Rewriting history before revoking. The secret is already copied elsewhere.
- Scanning only the default branch.
- Treating a private repository as safe. See whether a secret in a private repo is a problem.
- Ignoring the audit trail. Record who had access and when the key was last used.
How Safeguard helps
Safeguard provides SBOM and dependency scanning with reachability analysis, and policies, gates and guardrails you can apply before merge. You can try the free scan on a repository.
Quick check
Do I have to rewrite git history after a leak?
Not always. Revoking the credential is the essential step. Rewriting history is optional, has side effects, and does not help if the repository was already cloned.
Will scanning only the main branch find old secrets?
Only if they are reachable from main. Scan all branches and tags.
Sources
- GitHub Docs, About secret scanning (fetched 19 October 2026).
- OWASP Secrets Management Cheat Sheet (fetched 19 October 2026).
Last reviewed: 19 October 2026.
