Rewrite git history to remove committed secrets and PII.
npx skills add https://github.com/shellicar/skills --skill secret-remediation
Please help me install this Agent Skill. Skill: secret-remediation Source: https://github.com/shellicar/skills/tree/main/skills/secret-remediation Command: npx skills add https://github.com/shellicar/skills --skill secret-remediation
This Skill provides a repeatable, safety‑first workflow to rewrite git commit history to remove secrets and personally identifiable information that were committed and later detected by secret-scanning, and it emphasizes mandatory credential rotation for any value that reached a remote.
Run the secret-remediation workflow after secret-scanning identifies historical values by creating an expressions file, confirming the replacement plan with the Supreme Commander, running the search to preview matches, and then executing the scrub per affected branch with the required safety flag.
High-intent search queries and answers about installing and using this skill.
Use git filter-branch with sed replacement patterns to rewrite repository commits and remove committed secrets. This process scrubs affected branches by applying an expressions file of replacement patterns to targeted historical commits, replacing sensitive values.
The safest way to rewrite git history for secret scrubbing requires a clean working tree, backup tags, and per-branch execution. You run a read-only search to preview matches, then execute the destructive filter-branch scrub with an explicit flag for each affected branch separately.
Yes, mandatory credential rotation is required for any secret values that reached a remote repository. Rewriting git history removes the secret from commits, but any pushed credentials must be considered compromised and rotated immediately to prevent unauthorized access.
Yes, this secret remediation workflow handles pushed feature branches with PRs by applying sed expressions per commit via a tree-filter helper. You must run the scrub per affected branch and manually execute the force-push command to update the remote.
Prerequisites include a clean working tree and an expressions file of sed replacement patterns. Limitations involve requiring an explicit destructive flag to run the scrub, manual force-push execution to update remotes, and coordinated credential rotation for any values previously pushed.
An expressions file defines the sed replacement patterns used to scrub secrets per commit. A manual force-push is required because the destructive orchestrator rewrites history and prints the force-push command for manual execution, ensuring the remote update is deliberate and coordinated.
lshtramScan codebases for secrets and generate .env.example scaffolds with dummy values.
deandumEnforce pre-push checks for commit hygiene and force-push safety.
CC90210Enforce environment-variable isolation and detect leaked credentials in repositories.
ZurybrDetect and remove sensitive credentials from Git repositories and their commit history using pattern, file-based and entropy methods.
