You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository.md
+5-51Lines changed: 5 additions & 51 deletions
Original file line number
Diff line number
Diff line change
@@ -20,9 +20,9 @@ shortTitle: Remove sensitive data
20
20
21
21
## About removing sensitive data from a repository
22
22
23
-
When altering your repository's history using tools like `git filter-repo` or the BFG Repo-Cleaner, it's crucial to understand the implications, especially regarding open pull requests and sensitive data.
23
+
When altering your repository's history using tools like `git filter-repo`, it's crucial to understand the implications, especially regarding open pull requests and sensitive data.
24
24
25
-
The `git filter-repo` tool and the BFG Repo-Cleaner rewrite your repository's history, which changes the SHAs for existing commits that you alter and any dependent commits. Changed commit SHAs may affect open pull requests in your repository. We recommend merging or closing all open pull requests before removing files from your repository.
25
+
The `git filter-repo` tool rewrites your repository's history, which changes the SHAs for existing commits that you alter and any dependent commits. Changed commit SHAs may affect open pull requests in your repository. We recommend merging or closing all open pull requests before removing files from your repository.
26
26
27
27
You can remove the file from the latest commit with `git rm`. For information on removing a file that was added with the latest commit, see "[AUTOTITLE](/repositories/working-with-files/managing-large-files/about-large-files-on-github#removing-files-from-a-repositorys-history)."
28
28
@@ -48,37 +48,7 @@ If the commit that introduced the sensitive data exists in any forks, it will co
48
48
49
49
Consider these limitations and challenges in your decision to rewrite your repository's history.
50
50
51
-
## Purging a file from your repository's history
52
-
53
-
You can purge a file from your repository's history using either the `git filter-repo` tool or the BFG Repo-Cleaner open source tool.
54
-
55
-
> [!NOTE] If sensitive data is located in a file that's identified as a binary file, you'll need to remove the file from the history, as you can't modify it to remove or replace the data.
56
-
57
-
### Using the BFG
58
-
59
-
The [BFG Repo-Cleaner](https://rtyley.github.io/bfg-repo-cleaner/) is a tool that's built and maintained by the open source community. It provides a faster, simpler alternative to `git filter-repo` for removing unwanted data.
60
-
61
-
For example, to remove your file with sensitive data and leave your latest commit untouched, run:
62
-
63
-
```shell
64
-
bfg --delete-files YOUR-FILE-WITH-SENSITIVE-DATA
65
-
```
66
-
67
-
To replace all text listed in `passwords.txt` wherever it can be found in your repository's history, run:
68
-
69
-
```shell
70
-
bfg --replace-text passwords.txt
71
-
```
72
-
73
-
After the sensitive data is removed, you must force push your changes to {% data variables.product.product_name %}. Force pushing rewrites the repository history, which removes sensitive data from the commit history. If you force push, it may overwrite commits that other people have based their work on.
74
-
75
-
```shell
76
-
git push --force
77
-
```
78
-
79
-
See the [BFG Repo-Cleaner](https://rtyley.github.io/bfg-repo-cleaner/)'s documentation for full usage and download instructions.
80
-
81
-
### Using git filter-repo
51
+
## Purging a file from your repository's history using git-filter-repo
82
52
83
53
> [!WARNING] If you run `git filter-repo` after stashing changes, you won't be able to retrieve your changes with other stash commands. Before running `git filter-repo`, we recommend unstashing any changes you've made. To unstash the last set of changes you've stashed, run `git stash show -p | git apply -R`. For more information, see [Git Tools - Stashing and Cleaning](https://git-scm.com/book/en/v2/Git-Tools-Stashing-and-Cleaning).
84
54
@@ -178,7 +148,7 @@ To illustrate how `git filter-repo` works, we'll show you how to remove your fil
178
148
179
149
## Fully removing the data from {% data variables.product.prodname_dotcom %}
180
150
181
-
After using either the BFG tool or `git filter-repo` to remove the sensitive data and pushing your changes to {% data variables.product.product_name %}, you must take a few more steps to fully remove the data from {% data variables.product.product_name %}.
151
+
After using `git filter-repo` to remove the sensitive data and pushing your changes to {% data variables.product.product_name %}, you must take a few more steps to fully remove the data from {% data variables.product.product_name %}.
182
152
183
153
{% ifversion ghec %}
184
154
1. If the repository was migrated using the {% data variables.product.prodname_importer_proper_name %}, there may be some non-standard Git references that follow the pattern `refs/github-services`, that neither the BFG tool or `git filter-repo` can remove. In this case, remove those references running the following commands in your local copy of the repository:
@@ -205,22 +175,6 @@ After using either the BFG tool or `git filter-repo` to remove the sensitive dat
205
175
206
176
1. Tell your collaborators to [rebase](https://git-scm.com/book/en/v2/Git-Branching-Rebasing), _not_ merge, any branches they created off of your old (tainted) repository history. One merge commit could reintroduce some or all of the tainted history that you just went to the trouble of purging.
207
177
208
-
1. If you used `git filter-repo`, you can skip this step.
209
-
210
-
If you used the BFG tool, after rewriting, you can clean up references in your local repository to the old history to be dereferenced and garbage collected with the following commands (using Git 1.8.5 or newer):
211
-
212
-
```shell
213
-
$ git reflog expire --expire=now --all
214
-
$ git gc --prune=now
215
-
> Counting objects: 2437, done.
216
-
> Delta compression using up to 4 threads.
217
-
> Compressing objects: 100% (1378/1378), done.
218
-
> Writing objects: 100% (2437/2437), done.
219
-
> Total 2437 (delta 1461), reused 1802 (delta 1048)
220
-
```
221
-
222
-
> [!NOTE] You can also achieve this by pushing your filtered history to a new or empty repository and then making a fresh clone from {% data variables.product.product_name %}.
223
-
224
178
{% ifversion ghes %}
225
179
226
180
## Identifying reachable commits
@@ -245,7 +199,7 @@ If references are found in any forks, the results will look similar, but will st
245
199
ghe-nwo NWO
246
200
```
247
201
248
-
The same procedure using the BFG tool or `git filter-repo` can be used to remove the sensitive data from the repository's forks. Alternatively, the forks can be deleted altogether, and if needed, the repository can be re-forked once the cleanup of the root repository is complete.
202
+
The same procedure using `git filter-repo` can be used to remove the sensitive data from the repository's forks. Alternatively, the forks can be deleted altogether, and if needed, the repository can be re-forked once the cleanup of the root repository is complete.
249
203
250
204
Once you have removed the commit's references, re-run the commands to double-check.
Copy file name to clipboardExpand all lines: content/code-security/getting-started/best-practices-for-preventing-data-leaks-in-your-organization.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -105,7 +105,7 @@ To ensure that all code is properly reviewed prior to being merged into the defa
105
105
106
106
## Mitigate data leaks
107
107
108
-
If a user pushes sensitive data, ask them to remove it by using the `git filter-repo` tool or the BFG Repo-Cleaner open source tool. For more information, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)." Also, it is possible to revert almost anything in Git. For more information, see [{% data variables.product.prodname_blog %}](https://github.blog/2015-06-08-how-to-undo-almost-anything-with-git/).
108
+
If a user pushes sensitive data, ask them to remove it by using the `git filter-repo` tool. For more information, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)." Also, it is possible to revert almost anything in Git. For more information, see [{% data variables.product.prodname_blog %}](https://github.blog/2015-06-08-how-to-undo-almost-anything-with-git/).
109
109
110
110
At the organization level, if you're unable to coordinate with the user who pushed the sensitive data to remove it, we recommend you contact {% data variables.contact.contact_support %} with the concerning commit SHA.
Copy file name to clipboardExpand all lines: content/code-security/secret-scanning/introduction/about-secret-scanning.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -56,7 +56,7 @@ Below is a typical workflow that explains how {% data variables.product.prodname
56
56
57
57
***Remediation:** You then need to take appropriate actions to remediate the exposure. This might include:
58
58
* Rotating the affected credential to ensure it is no longer usable.
59
-
* Removing the secret from the repository's history (using tools like BFG Repo-Cleaner or {% data variables.product.prodname_dotcom %}'s built-in features).
59
+
* Removing the secret from the repository's history (using tools like `git-filter-repo` or {% data variables.product.prodname_dotcom %}'s built-in features).
60
60
61
61
***Monitoring:** It's good practice to regularly audit and monitor your repositories to ensure no other secrets are exposed.
Copy file name to clipboardExpand all lines: content/repositories/working-with-files/managing-large-files/about-large-files-on-github.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -98,7 +98,7 @@ If the file was added with your most recent commit, and you have not pushed to {
98
98
99
99
### Removing a file that was added in an earlier commit
100
100
101
-
If you added a file in an earlier commit, you need to remove it from the repository's history. To remove files from the repository's history, you can use the BFG Repo-Cleaner or the `git filter-repo` command. For more information see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
101
+
If you added a file in an earlier commit, you need to remove it from the repository's history. To remove files from the repository's history, we recommend the `git filter-repo` command. For more information see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
Copy file name to clipboardExpand all lines: content/repositories/working-with-files/managing-large-files/moving-a-file-in-your-repository-to-git-large-file-storage.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -16,9 +16,9 @@ After installing {% data variables.large_files.product_name_short %} and configu
16
16
{% data reusables.large_files.resolving-upload-failures %}
17
17
18
18
> [!TIP]
19
-
> If you get an error that "this exceeds {% data variables.large_files.product_name_short %}'s file size limit of {% data variables.large_files.max_github_size %}" when you try to push files to Git, you can use `git lfs migrate` instead of `filter-repo` or the BFG Repo Cleaner, to move the large file to {% data variables.large_files.product_name_long %}. For more information about the `git lfs migrate` command, see the [Git LFS 2.2.0](https://github.com/blog/2384-git-lfs-2-2-0-released) release announcement.
19
+
> If you get an error that "this exceeds {% data variables.large_files.product_name_short %}'s file size limit of {% data variables.large_files.max_github_size %}" when you try to push files to Git, you can use `git lfs migrate` instead of `filter-repo`, to move the large file to {% data variables.large_files.product_name_long %}. For more information about the `git lfs migrate` command, see the [Git LFS 2.2.0](https://github.com/blog/2384-git-lfs-2-2-0-released) release announcement.
20
20
21
-
1. Remove the file from the repository's Git history using either the `filter-repo` command or BFG Repo-Cleaner. For detailed information on using these, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
21
+
1. Remove the file from the repository's Git history using the `filter-repo` command. For detailed information on using these, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
22
22
1. Configure tracking for your file and push it to {% data variables.large_files.product_name_short %}. For more information on this procedure, see "[AUTOTITLE](/repositories/working-with-files/managing-large-files/configuring-git-large-file-storage)."
Copy file name to clipboardExpand all lines: content/repositories/working-with-files/managing-large-files/removing-files-from-git-large-file-storage.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ shortTitle: Remove files
13
13
---
14
14
## Removing a single file
15
15
16
-
1. Remove the file from the repository's Git history using either the `filter-repo` command or BFG Repo-Cleaner. For detailed information on using these, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
16
+
1. Remove the file from the repository's Git history using the `filter-repo` command. For detailed information on using these, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
17
17
1. Navigate to your _.gitattributes_ file.
18
18
19
19
> [!NOTE]
@@ -24,7 +24,7 @@ shortTitle: Remove files
24
24
25
25
## Removing all files within a {% data variables.large_files.product_name_short %} repository
26
26
27
-
1. Remove the files from the repository's Git history using either the `filter-repo` command or BFG Repo-Cleaner. For detailed information on using these, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
27
+
1. Remove the files from the repository's Git history using the `filter-repo` command. For detailed information on using these, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)."
28
28
1. Optionally, to uninstall {% data variables.large_files.product_name_short %} in the repository, run:
0 commit comments