I scanned all of GitHub's "oops commits" for leaked secrets

> GitHub keeps these dangling commits, from what we can tell, forever.

Not if you contact customer support and ask them to garbage collect your repo.

What I do when I accidentally push something I don’t want public:

- Force push;

- Immediately rotate if it’s something like a secret key;

- Contact customer support to gc the repo (and verify the commit is gone afterwards).

(Of course you should consider the damage done the moment you pushed it. The above steps are meant to minimize potential further damage.)

If you rotated the secret, why do anything else? I don't think there is any potential further damage (except maybe reputational).

1. Not all secrets can be rotated. E.g. I can't just "rotate" my home address, which I prefer to be private.

2. Even for rotatable secrets, "I don't think there is any potential further damage" rests on the assumption that the secret is 100% invalidated everywhere. What if there are obscure and/or neglected systems, possibly outside of your control, that still accept that secret? No system is bug-free. If I can take steps to minimize access to an invalidated secret, I will.