Question 1

How do I remove a file containing secrets from Git history?

Accepted Answer

Start with the part people skip: if a credential was pushed anywhere others could read it, treat it as compromised and rotate it first. Rewriting history removes the file from the repository, but it cannot un-read anything already cloned, forked, cached by a hosting provider, or picked up by an automated scanner. Rotation is the fix; history rewriting is cleanup.

Deleting the file in a new commit is not sufficient, because every earlier commit still contains it and anyone can check out those commits. The content has to be removed from the commits themselves, which means rewriting them.

The recommended approach is a purpose-built history rewriting tool, which is considerably faster and safer than the built-in branch filter older instructions suggest. It removes the specified paths from every commit and rewrites the affected history.

Several consequences follow, and they are why this is disruptive rather than routine.

- Every rewritten commit gets a new hash, so the rewritten branch and the original have diverged completely and pushing requires force.
- Everyone else must re-clone or reset to the rewritten history. Merging an old clone back in reintroduces the very commits you removed, which is a common way for this to fail after the fact.
- Open pull requests, tags and any references built on the old commits need attention.
- Hosting providers often keep unreachable objects accessible for a period, so you may need to ask them to run garbage collection.

Take a full backup clone before starting, because the operation is not reversible in place.

The durable prevention is keeping secrets out of the repository entirely, using environment variables or a secret manager, and adding a scanning hook that rejects a commit containing credential-shaped strings before it is ever created.

Question 2

How should application secrets actually be managed?

Accepted Answer

Kept out of source code entirely, injected at runtime, scoped narrowly, and rotatable without a deployment — and the reason this matters is that a secret committed to a repository is permanently

Question 3

How do I undo the last commit in Git without losing my changes?

Accepted Answer

Which command you want depends on whether the commit has been pushed, because that decides whether rewriting history is safe. If the commit is still local, a soft reset to the previous commit is what

Question 4

When should I use git rebase instead of git merge?

Accepted Answer

Both commands integrate work from one branch into another, and they differ in what happens to history. Merge records that two lines of development came together, creating a merge commit with two

Question 5

What does git stash do and when should I use it?

Accepted Answer

Stashing takes your uncommitted changes, saves them aside, and returns the working tree to a clean state matching the last commit. The changes are not lost; they are stored on a stack you can reapply

Question 6

How does Git actually store your files?

Accepted Answer

As complete snapshots, not as differences — which is the single fact that makes Git's behaviour comprehensible, because almost every mental model imported from older version control systems is wrong

Question 7

What is a merge conflict and how do I resolve it?

Accepted Answer

A conflict occurs when two branches changed the same region of a file and Git cannot determine which version is correct. It is not an error, and it does not mean anyone did anything wrong. Git

Related Questions