Heads up — found exposed credentials in .env.env.backup.
The file .env.env.backup contains environment secrets and is committed to this repository's public git history. Anyone browsing the repo can see it.
Rotate any credentials that were in this file now. The secrets are in git history, so removing the file from HEAD is not enough. Revoke and regenerate each key with its provider before anything else.
After rotating:
- Run
git rm --cached .env.env.backup to stop tracking the file.
- Add
.env.env.backup to .gitignore if it isn't already covered.
- Rewriting history (BFG or git filter-repo) reduces the exposure window but is optional once rotation is done.
Found by https://github.com/molloyzak13/zak-guard, a pre-commit hook that catches this class of leak. Feedback welcome if you try it.
Heads up — found exposed credentials in
.env.env.backup.The file
.env.env.backupcontains environment secrets and is committed to this repository's public git history. Anyone browsing the repo can see it.Rotate any credentials that were in this file now. The secrets are in git history, so removing the file from HEAD is not enough. Revoke and regenerate each key with its provider before anything else.
After rotating:
git rm --cached .env.env.backupto stop tracking the file..env.env.backupto.gitignoreif it isn't already covered.Found by https://github.com/molloyzak13/zak-guard, a pre-commit hook that catches this class of leak. Feedback welcome if you try it.