Removing sensitive content from GIT | BFG

Using BFG

BFG is one great open source tool which is an alternative for git filter repo maintained by Roberto Tyley.

Use Case

Today I am using this to clear alias key and password that I unknowingly pushed to the repo and is present in all the commits. It is present in gradle.properties inside android folder.

Installation

You can download jar file from BFG website and install using java.

Installing with brew

You can use: brew install bfg
command to install bfg directly from terminal

I had to use arch -arm64 in my m1Mac book.

arch -arm64 brew install bfg

Creating backup

It is recommended to create backup before performing the modification.

cp -R path/to/Project path/to/Project_backup


Create replacements.txt file

Write the codes or passwords in this file that you want to be removed.

BFG crawls your repo and removes the codes from this file.

Default is changed to Removed

source:

Run replace text command

Now run the following command. This will change the passwords to REMOVED or custom texts and crawls all the commits and also updates them.

bfg --replace-text path/to/replacements.txt path/to/Project

After running above command, it will prompt following to be executed:

git reflog expire --expire=now --all && git gc --prune=now --aggressive

Commit protection

I ran into commit protection where adding this --no-blob-protection
solved it.

Pushing to git

Now you can push to git using force push

git push -uf

You can now check in Git, if your updates are present now.