I scanned all of GitHub's "oops commits" for leaked secrets

> GitHub keeps these dangling commits, from what we can tell, forever.

Not if you contact customer support and ask them to garbage collect your repo.

What I do when I accidentally push something I don’t want public:

- Force push;

- Immediately rotate if it’s something like a secret key;

- Contact customer support to gc the repo (and verify the commit is gone afterwards).

(Of course you should consider the damage done the moment you pushed it. The above steps are meant to minimize potential further damage.)