Removing API Keys from Git History: BFG + Force Push (A Security Incident Response)

Published on: 2026-06-06

Reading time: 5 min

Tags: #security #git #devops #secrets

The Situation

API keys were committed to .env file in Git history. Anyone with repo access could do git log and see them.

git log --all --full-history --name-only | grep ".env"
# abc1234 Remove .env from version control
# def5678 Initial commit: Contest Agent

Immediate risk:

• Clone repo → check git history → steal API keys
• If pushed to GitHub, keys are potentially searchable/cached

Solution: BFG Repo-Cleaner

Better than git filter-branch (faster, safer):

Step 1: Install BFG

brew install bfg

Step 2: Delete from History

cd your-project
bfg --delete-files ".env" --no-blob-protection .

Output:

Deleted files:
  Deleted 4 commits
  Deleted 12 blob(s)
  ...

Step 3: Clean Up

git reflog expire --expire=now --all
git gc --prune=now --aggressive

Step 4: Verify

git log --all --full-history --name-only | grep ".env"
# (no output = success)

Step 5: Force Push

git push origin main --force-with-lease

Before & After

Before BFG:

$ git log --oneline | head -5
abc1234 Remove .env from version control
def5678 Enable SSL certificate verification
ghi9012 Standardize dependencies

After BFG:

$ git log --oneline | head -5
xyz3456 Remove duplicate service definition
uvw7890 Standardize dependencies
rst1234 Enable SSL certificate verification

Unnecessary commits removed, history cleaned.

BFG vs git filter-branch

CRITICAL: Rotate API Keys

Cleaning git history is step 1. Step 2 is mandatory:

Timeline: Do This Immediately

Within 1 hour:

# Anthropic
# → https://console.anthropic.com/account/keys
# → Delete old key, generate new one

# Supabase
# → https://app.supabase.com → Settings → API
# → Click "Reset secret key"

# Telegram
# → Open @BotFather
# → /token → select bot → /revoke
# → Generate new token

Within 24 hours:

• Update all deployed servers with new keys
• Test that services still work
• Monitor logs

Best Practices Going Forward

1. Initialize Correctly from Day One

# First thing in new project:
echo ".env" >> .gitignore
git add .gitignore
git commit -m "Add .env to .gitignore"

2. Create .env.example

# .env.example
ANTHROPIC_API_KEY=your-key-here
SUPABASE_URL=your-url-here
TELEGRAM_BOT_TOKEN=your-token-here

3. Use GitHub Actions Secrets

# .github/workflows/deploy.yml
env:
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  SUPABASE_KEY: ${{ secrets.SUPABASE_KEY }}

4. Add Pre-Commit Hook (Optional)

#!/bin/bash
# .git/hooks/pre-commit

if git diff --cached --name-only | grep -E '\.env'; then
    echo "❌ Error: Attempting to commit .env file"
    exit 1
fi

Real Impact (After Remediation)

Before:
- .env in git history
- 79 commits total
- History size: 50MB

After BFG:
- .env removed from all commits
- 75 commits total (4 cleaned)
- History size: 42MB (-16%)

Execution Checklist

Phase 1: Immediate (Next 1 hour)

• [ ] Run BFG: bfg --delete-files ".env" .
• [ ] Clean git: git reflog expire ... && git gc ...
• [ ] Force push: git push origin main --force-with-lease

Phase 2: Rotate (Next 24 hours)

• [ ] Anthropic API key
• [ ] Supabase Secret Key
• [ ] Telegram Bot token

Phase 3: Prevention

• [ ] Update deployed servers with new keys
• [ ] Create .env.example
• [ ] Update .gitignore
• [ ] Add GitHub Actions secrets
• [ ] Notify team (force push happened)

Phase 4: Future

• [ ] Set up pre-commit hooks
• [ ] Monthly secret audit
• [ ] Use Secret scanning tools (GitHub, GitLab)

Key Takeaway

API key exposure is a security incident, not a "mistake."

• Act fast (BFG)
• Rotate keys (mandatory)
• Document the response
• Prevent recurrence

Your security posture will be better for it—and you'll have a good story for the next security audit.