How to Scan Force Pushed Commits for Secrets

15 mmcclure 4 7/31/2025, 5:10:21 PM trufflesecurity.com ↗

Comments (4)

londons_explore · 3h ago
I really don't see how GitHub can justify allowing public access to dangling commits.

Surely they have a whole army of paying customers demanding proper data deletion ability (required for all kinds of legal reasons - eg. We accidentally committed code we don't have a licence for, or PII of Europeans, etc).

A simple rule saying 'any commit which ever has a refcount of zero will become forever inaccessible unless reuploaded' would do the trick.

orbisvicis · 6h ago
I believe git gc after force-push will remedy the situation by deleting all unreachable objects, even circular references.
kingstnap · 2h ago
How would you ever end up with a circular reference?
londons_explore · 3h ago
Locally yes, but not on GitHub.