skills.rest
lazyFrogLOL
lazyFrogLOLCOMMUNITY
Explore all skills by this author →
GitHub

sanitize-git-repo

Scan git repositories for secrets and rewrite history to remove them.

127|27|Updated Mar 27, 2026
Search Tags:#git#security#sanitization#secrets#git-filter-repo#credential-rotation#bfg
One-click install
npx skills add https://github.com/lazyFrogLOL/Harness_Engineering --skill sanitize-git-repo-lazyfroglol
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sanitize-git-repo
Source: https://github.com/lazyFrogLOL/Harness_Engineering/tree/main/skills/sanitize-git-repo
Command: npx skills add https://github.com/lazyFrogLOL/Harness_Engineering --skill sanitize-git-repo-lazyfroglol

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams find and remove sensitive credentials, API keys, tokens, and other secrets accidentally committed to a repository, and ensures those secrets are removed from both the working directory and git history to prevent future leaks.

Core Features & Use Cases

  • Comprehensive Detection: Pattern-based matching, file-type scanning, and entropy analysis to locate candidate secrets across text and binary files.
  • Systematic Verification: Document findings, categorize true positives vs false positives, and validate file integrity after replacements.
  • Sanitization Strategies: Safe working-directory replacements with consistent placeholders, plus history rewriting options (BFG, git-filter-repo, or git filter-branch) and guidance on post-rewrite coordination.
  • Post-Remediation Verification: Re-scan repository and history, validate configuration syntax, and recommend credential rotation and forced re-clone for collaborators.
  • Use Cases: Preparing a private repo for public release, responding to a leaked key, performing security audits, and meeting compliance requirements.

Quick Start

Run a comprehensive secret scan across the repository, replace discovered secrets with consistent placeholders, rewrite git history with a tool like BFG or git-filter-repo, and rotate any exposed credentials.

Frequently Asked Questions about sanitize-git-repo

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I remove secrets and API keys from git history before making a repository public?▼

To remove secrets from git history before a public release, you can rewrite commits using tools like BFG or git-filter-repo. This process scans for embedded credentials, replaces them with placeholders, and rewrites the historical commit tree to eliminate past leaks.

What is the best way to sanitize a git repository after a credential leak?▼

The best way to sanitize a git repository after a credential leak is to perform pattern-based and entropy scanning to locate exposed tokens, rewrite history with git-filter-repo or BFG, and immediately rotate the compromised credentials to secure access.

Does git-filter-repo permanently delete sensitive files from past commits?▼

Yes, git-filter-repo permanently deletes sensitive files and text from past commits by rewriting the repository history. After rewriting, collaborators must force a fresh re-clone of the sanitized repository to ensure no local copies retain the old secrets.

Can I use BFG to replace API keys with placeholders instead of deleting the entire file?▼

Yes, BFG can replace specific API keys with placeholder text using a custom replacement file, preserving non-sensitive file content. This targeted text replacement ensures the repository continues to build correctly while removing the embedded secrets from history.

Why do I need to rotate credentials after removing secrets from git history?▼

You need to rotate credentials after removing secrets from git history because the exposed keys may have already been cloned or scraped by unauthorized parties. Sanitizing the repository prevents future exposure, but rotating credentials invalidates any previously leaked access tokens.

How does entropy scanning find secrets in a git repository?▼

Entropy scanning finds secrets in a git repository by measuring the randomness of text strings to detect high-entropy candidate tokens, such as API keys. This method identifies non-standard credentials that pattern-based matching might miss, ensuring comprehensive security audits.

Related Skills

Explore More Software Engineering Skills→
CuriousLearnerCuriousLearner
27

secret-scanner

Detect and report exposed secrets in code repositories using regex and entropy analysis.

Community
Advanced
Clear-CapabilitiesClear-Capabilities
73

agentic-security:security-rotate-leak

Rotate leaked API keys and credentials end-to-end across supported providers.

Official
Advanced
eleva-labseleva-labs

security-audit

Plan security audits with checklists for dependency scanning and secret detection.

Official
Basic
bianhaifeng789-huebianhaifeng789-hue

sanitize-git-repo

Detect and remove committed secrets from git repositories and history.

Community
Advanced