Removing sensitive data from git history¶

Overview¶

It’s crucial to understand why removing sensitive data from your Git history is essential.

Sensitive information like passwords, API keys, and personal data can inadvertently find their way into commits. Once committed, this information becomes a part of your project’s permanent record, putting your system and user data at risk.

The Process: How to remove sensitive data ?¶

Git’s filter-branch command lets you rewrite the repository history. However, there is a simpler and faster alternative for cleansing bad data out of your Git repository history: the BFG application.

Here’s a step-by-step guide on how to scrub sensitive data from your Git history:

Clean up sensitive data from your source code and commit your changes to ensure that your latest commit is clean.
Clone a bare Git repository using the git clone --mirror command and create a backup. The --mirror flag instructs Git to pull all the repository’s references.

package-manager.git is example repo
```
git clone --mirror git@gitlab.com:pss-x/support/package-manager.git
```
Extend the existing replacements.txt file with the value (e.g. token) to be purged. Remove sensitive data in your entire Git repository history with the following command:
```
java -jar bfg-1.14.0.jar --replace-text replacements.txt package-manager.git
```
You can also purge sensitive files from your commit history with the command:
```
java -jar bfg-1.14.0.jar --delete-files <filename> package-manager.git
```
example for install.ps1 file remove from existing commits
```
java -jar bfg-1.14.0.jar --no-blob-protection --delete-files install.ps1 package-manager.git
```
Git references the deleted commits in the reflog and retains them in the database as dangling commits for a time. These can be removed manually using the following commands:
```
cd package-manager.git
git reflog expire --expire=now --all && git gc --prune=now --aggressive
```
Push your changes to your remote repository, using git push, to update your commits and references.
```
git push -f
```
Next pull operation may fail due to following error: "fatal: refusing to merge unrelated histories"

You can accept altered history by using following command
```
git pull --allow-unrelated-histories
```