DEV Community

Cristian Sifuentes
Cristian Sifuentes

Posted on

Git Secrets, Push Protection, and Real-World Recovery: An Expert Walkthrough

#git #backend #softwaredevelopment #programming

Git Secrets, Push Protection, and Real-World Recovery

Git Secrets, Push Protection, and Real-World Recovery: An Expert Walkthrough

What happens when Git meets enterprise-grade protection? Let's walk through a real and professional workflow.

The Real-World Scenario

You're organizing your Azure CLI automation scripts across services:

  • vms/comandos.sh
  • azureIaaS/IassArchitecture.sh
  • rbac/comandos.sh
  • zeroTrust/comandos.sh

You're working on the main branch, making a batch commit that introduces 15 files and over 290 insertions. Everything looks great:

git commit -m "Add commands"
Enter fullscreen mode Exit fullscreen mode

Then you push:

git push origin main
Enter fullscreen mode Exit fullscreen mode

🚨 And GitHub blocks your push:

GH013: Repository rule violations — Push cannot contain secrets

What Went Wrong?

The push was rejected because GitHub's Push Protection detected an Azure Active Directory Application Secret inside rbac/comandos.sh.

GitHub detected:

  • Path: rbac/comandos.sh:20
  • Commit: b1bce378ff35bc5...

This is a serious matter: the commit history now includes a potential secret that may compromise cloud resources if leaked.

Recovery Strategy (Step-by-Step)

Step 1: Prevent Further Exposure

Immediately notify your team and rotate the leaked secret in Azure.

Step 2: Remove the Secret from Git History

You cannot simply delete the file and recommit—it exists in Git history. Instead, use filtering:

git filter-repo --path rbac/comandos.sh --invert-paths
Enter fullscreen mode Exit fullscreen mode

Or for a more targeted removal:

git rebase -i HEAD~5
# Remove or edit the offending commit
Enter fullscreen mode Exit fullscreen mode

Alternatively, use BFG Repo Cleaner:

bfg --delete-files rbac/comandos.sh
Enter fullscreen mode Exit fullscreen mode

Step 3: Force Push Cleaned History

Once the secret is removed from history:

git push origin main --force
Enter fullscreen mode Exit fullscreen mode

✅ GitHub will now allow your push.

Advanced Git Techniques Explained

1. Why filter-repo over rebase?

Rewriting deep history is easier with filter-repo (or bfg). Interactive rebase is effective for recent commits but can be cumbersome for large repos.

2. How Push Protection Works

GitHub checks commits for credential patterns and blocks pushes before they enter the remote repository. This helps prevent security leaks.

Best Practices: Git Security and Secrets

Practice Why It Matters
Use .env files + .gitignore Keeps secrets out of tracked files
Enable Push Protection Blocks secrets before they hit GitHub
Use GitHub Actions Secrets Secure storage for workflow credentials
Rotate secrets regularly Prevent exposure from forgotten history
Avoid committing from main Safer development via feature/* branches

Bonus: Protecting Future Commits

Add a Pre-Commit Hook 

#!/bin/sh
grep -r --exclude-dir=".git" -E "(AKIA|AIza|secret|password|client_secret)" . && echo "🚫 Possible secret found!" && exit 1
Enter fullscreen mode Exit fullscreen mode

Save it as .git/hooks/pre-commit and make it executable:

chmod +x .git/hooks/pre-commit
Enter fullscreen mode Exit fullscreen mode

Key Takeaways

  1. GitHub Push Protection is critical for secret safety—but requires proactive development hygiene.
  2. Rewriting Git history is a professional responsibility when secrets are leaked.
  3. filter-repo, BFG, and rebase -i are essential tools in a Git expert's toolbox.
  4. Prevent future mistakes with .gitignore, environment files, and secure workflows.
  5. Git is not just version control—it’s a safety net, audit trail, and accountability system.

Closing Thought

In modern development, version control isn’t just about code—it's about security, integrity, and responsibility. GitHub Flow + Push Protection is a powerful combo when used thoughtfully.

Become the kind of engineer who merges features with clarity—and secures secrets with confidence.

Follow for more Git mastery, DevOps insights, and cloud engineering best practices.

✍️ Written by: Cristian Sifuentes – Full-stack dev crafting scalable apps with [NET - Azure], [Angular - React], Git, SQL & extensions. Clean code, dark themes, atomic commits

Top comments (0)