Comprehensive Technical Guide: Removing Sensitive Files and Their Commits from Git History

Security Prerequisites and Risk Assessment

Before initiating any Git history rewriting operations, the paramount task is to immediately rotate all compromised passwords and credentials. If sensitive data has been pushed to remote repositories and cloned by others, merely removing files from local history cannot eliminate risks in other copies. Credential rotation forms the fundamental security barrier that must be completed prior to technical manipulations.

Core Tools and Technical Implementation

History Rewriting with git filter-branch

git filter-branch serves as Git's built-in tool for systematic commit history modification. The following command demonstrates complete removal of all historical traces for specified files:

git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch config/deploy.rb" \
  --prune-empty --tag-name-filter cat -- --all

Parameter analysis: --index-filter operates directly on the index, offering better efficiency than tree filters; --ignore-unmatch ensures no errors when files are absent; --prune-empty automatically removes empty commits resulting from file deletions; --tag-name-filter cat preserves tag names unchanged.

Modern Approach Using git filter-repo

git filter-repo provides a more modern and efficient alternative with optimized functionality specifically for sensitive data removal:

git-filter-repo --sensitive-data-removal --invert-paths --path config/deploy.rb

This tool automatically handles reference updates and garbage collection, offering superior performance and security compared to git filter-branch. After installation, it can be used directly without complex parameter configurations.

Correction Methods for Recent Commits

For sensitive data appearing in recent commits that haven't been pushed, lighter correction methods are available:

git rm config/deploy.rb
git commit --amend --no-edit

For sensitive commits located deeper in history, interactive rebase provides precise modification control:

git rebase -i HEAD~5
# Mark target commits as edit, then at each pause point execute:
git rm config/deploy.rb
git commit --amend --no-edit
git rebase --continue

Side Effects of History Rewriting and Mitigation Strategies

Impact on Collaborative Environments

History rewriting alters commit hashes, causing branch divergence in all clones based on old history. Collaborating developers must either delete existing clones and re-clone, or execute git rebase --interactive to resolve conflicts. Team coordination becomes critically important throughout this process.

Compatibility Issues with Platform Features

Pull request systems on platforms like GitHub rely on fixed commit hashes. History rewriting invalidates diff views for closed pull requests, potentially causing comment loss. It's recommended to merge or close all open pull requests before rewriting history.

Signature Verification Failures

GPG signatures are computed based on commit content hashes. History modifications invalidate existing signatures, and tools like git filter-repo typically remove signatures entirely, requiring re-signing of important commits after operations.

Remote Repository Cleanup and Synchronization

After local history rewriting completes, forced pushing to remote repositories is necessary:

git push --force --verbose --dry-run  # Preview push operation
git push --force  # Execute actual force push

For GitHub repositories, additional steps involve contacting support teams to clean cached references and orphaned objects on server-side, ensuring sensitive data is completely removed from all storage layers.

Preventive Measures and Best Practices

Engineering Protection Mechanisms

Establish comprehensive protection systems during project initialization: add sensitive file patterns to .gitignore and commit this configuration; employ pre-commit hook tools like git-secrets for automatic leak detection; avoid blanket commands like git add . in favor of explicit file specification.

Security Design at Architectural Level

Adopt environment variables or professional secret management services (e.g., HashiCorp Vault) for credential storage, fundamentally avoiding hard-coded sensitive information. Code review processes should include security inspections, particularly focusing on configuration files and credential handling logic.

Team Collaboration Standards

Establish clear data handling protocols, ensure all team members use visual tools to review commit changes, and conduct regular security training. Enable push protection features to intercept commits containing sensitive patterns before code enters repositories.