What problem does it solve?
Accidentally committed secrets, internal domains, IPs, or PII remain in Git history even after deletion, and force-pushing a rewritten history to a public repo without verification can make leaks worse. This Skill provides a conservative, safety-gated workflow to scan, back up, rewrite, verify, and push a cleaned repository.
Core Features & Use Cases
- Multi-layer scanning: Combines gitleaks, custom regex patterns, private gitleaks config rules, and a mandatory AI semantic review to find secrets and private context across all commits.
- Safe history rewriting: Creates a verified git bundle backup before running git-filter-repo, covering both file content and commit messages.
- Guarded push: Verifies repository visibility and fork count with gh before force-pushing with --force-with-lease, and never uses --no-verify.
- Use Case: You pushed an internal domain and an API key to a public repo with forks. Rotate the key, then use this Skill to scan the history, rewrite both blobs and commit messages, verify nothing remains, and push safely.
Quick Start
Use the github-sensitive-data-cleanup skill to scan my repository for leaked secrets and guide me through safely rewriting its history.
