How to Scan Force Pushed Commits for Secrets

16 mmcclure 4 7/31/2025, 5:10:21 PM trufflesecurity.com ↗

Comments (4)

londons_explore · 8h ago
I really don't see how GitHub can justify allowing public access to dangling commits.

Surely they have a whole army of paying customers demanding proper data deletion ability (required for all kinds of legal reasons - eg. We accidentally committed code we don't have a licence for, or PII of Europeans, etc).

A simple rule saying 'any commit which ever has a refcount of zero will become forever inaccessible unless reuploaded' would do the trick.

orbisvicis · 11h ago
I believe git gc after force-push will remedy the situation by deleting all unreachable objects, even circular references.
londons_explore · 8h ago
Locally yes, but not on GitHub.
kingstnap · 7h ago
How would you ever end up with a circular reference?