# Secret leaked in git history

Canonical page: /glossary/secret-in-git-history

API keys & secrets glossary, Mistakes & leaks. A Secret Leaked in Git History: Why Deleting the File Isn't Enough

**Short answer:** A secret leaked in git history means a key or password was committed at some point, and even though a later commit may delete or replace it, the original value remains readable in the repository's history unless that history is explicitly rewritten.

## Why it matters

Anyone who clones the repository, or who has access to it on a platform like GitHub, can check out an old commit or search the history to find the original value, regardless of what the current files show.

## In Claude Keychain

The only real fix once a secret is in git history is to revoke and replace it. Claude Keychain does not change this fact, but it removes the reason the secret would end up in a file in the first place.

## Common questions

**Does deleting the file remove the secret from git?**

No, not from history. The old commit still contains it, and the only reliable fix is revoking the exposed value.

**Can I rewrite git history to remove a secret?**

Yes, with tools built for that, but it rewrites commit hashes for everyone with the repository, which is disruptive and does not undo a leak that already happened.

## Related

[Hardcoded secret](/glossary/hardcoded-secret), [.gitignore](/glossary/gitignore), [Revoking an API key](/glossary/revoke-api-key)