Hide password in all previous commits on Github repo

Question

I have uploaded my project on GitHub public repo. But one of the files contains my password information. And there are several commits I have made already. How can I hide my password right from the initial commit?

There is no separate file for a password. So I can't use .gitignore in this case. A password is hardcoded in the app.py file which handles the main logic of the application. So, I can't use BFG Repo-Cleaner. Is it possible to delete the file and add a new one by overwriting the previous commit?

I have made the changes in the file and pushed in a repo. But still, previous commits shows my password information. Also, I am not interested in creating a new repo and deleting the old one(unless I have no other choice).

I would be glad if I get some help.

Thanks in advance.

Keldah

Possible duplicate of Completely remove file from all Git repository commit history - this answer https://mcmap.net/q/12573/-how-do-you-fix-a-bad-merge-and-replay-your-good-commits-onto-a-fixed-merge ccovers it. – Frambesia

Before you do anything else, change your password. The one you uploaded is forever compromised. – Bandeau

@Bandeau yes I have changed my password. Thanks – Keldah

@PatrickArtner Thank you so much for responding. But the problem is I have hardcoded the password in the file which handles the main logic of my application. So I cannot delete that file. – Keldah

@AkshayC, so un-hardcode it. There are lots of ways to pull configuration in from non source-controlled files, e.g. using environment variables. – Bandeau

Answer 1

GitHub has an article for exactly this. Check it out here. To sum up the article: you can use either the git filter-branch command or the BFG Repo-Cleaner. BFG Repo-Cleaner is easier and faster to use, so I use that. To use BFG Repo-Cleaner follow these steps:

1. Download the jar file at the project repo or with macos use brew install bfg
2. Clone a fresh copy of your repo, using the --mirror flag:

git clone --mirror git://example.com/some-big-repo.git

if using SSH or

git clone --mirror https://example.com/some-big-repo.git

if using HTTPS.

This is a bare repository so you won't be able to see your files but it will be a full copy of your repository with all commits.

3. You can then use the following command to delete specific files from previous commits:

java -jar bfg.jar --delete-files [FILE NAME] --no-blob-protection my-repo.git

or if installed to the PATH

bfg --delete-files [FILE NAME] --no-blob-protection my-repo.git

or to delete a password from an old commit

bfg --replace-text passwords.txt

4. Before pushing back up to your repo, check that the repo history has changed by going into your git repo folder and running the following command:

git reflog expire --expire=now --all && git gc --prune=now --aggressive

and then

git gc

to strip out unwanted data that you don't want to push back up to your repo.

5. Once your happy, push back up to your remote repo by running git push - note that, because you used the --mirror flag when cloning your repo, when you push back to your repo, you will also push back reference changes.

To read up more about BFG Repo-Cleaner, visit this link.

Baro

This is a comment (a good one, never mind). Answers should never be link-only. See why-do-i-need-50-reputation-to-comment-what-can-i-do-instead An answer should be valid even if the link goes down. – Frambesia

Thank you for editing and responding to feedback your answer is much more acceptable for this site, and suits the Q&A format. :) – Sandeesandeep

Thank you, Patrick. I appreciate your efforts. I have to read this in detail. But I need that file which has password. Because that file handles main logic of my application. So I can't delete that file. – Keldah

Hi Akshay C. I answered the question and here's a link to an answer which answers your question. stackoverflow.com/a/2397905 – Baro

@PritamSangani Thank you so much for the detailed information on BFG Repo-Cleaner. But in this case, it won't be useful for me, because the password is saved in the same file which handles the main logic for the app. So I cannot delete this file. Is there a way to delete the file and upload a new one by overwriting the previous commit? – Keldah

You should keep all passwords in a separate file. Then you should commit your new file without passwords and then follow the steps in the answer. – Baro

Sorry never mind, I think I should read it carefully. I am a newbie to this. – Keldah

You can use the BFG Repo Cleaner to delete your previous commit history so the old file will not be visible – Baro

Oh, I see. Thank you so much, sir. I appreciate it. – Keldah

Answer 2

first take a copy of the file(ie app.py)

remove the file(replace PATH-TO-YOUR-FILE-WITH-SENSITIVE-DATA with path/to/app.py) from git history(you also need to push the repo if you cloned from a remote repository):

git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch PATH-TO-YOUR-FILE-WITH-SENSITIVE-DATA" \
  --prune-empty --tag-name-filter cat -- --all
git push --force --verbose --dry-run
git push --force

now remove the passwords from app.py file and move it to git repo, then add and commit

Falsify

Answer 3

Here is an alternative and quick workaround to change sensible data without removing files.

# Sync with the remote master
git pull

# Force your clone to look like HEAD
git reset --hard

# AGAIN, A WARNING: This can really break stuff!

# Run your filter branch command, replacing all instances of "password" with "your_password"
# The example looks for Ruby files ("*.rb"), you can change this to match your needs
git filter-branch --tree-filter 'git ls-files -z "*.rb" |xargs -0 perl -p -i -e "s#(password)#your_password#g"' -- --all

# Overwrite your master with local changes
git push origin master --force

Source: https://palexander.posthaven.com/remove-a-password-from-gits-commit-history-wi

Jarrad