Removing a .env file from Git history

I'm a full-stack developer from South Africa 🇿🇦. I love writing about JavaScript, HTML and CSS.

What's the point in doing this? Regardless of what's in git, the credentials need revoked and git-ignored to prevent in the future. Removing from git history is some extra steps that doesn't really do anything.

Chris Bongers4y ago

Hey Jimmie,

I just like clean repo's. And like I said the env is more a demonstration of a common example.

It might have been another file you wish to remove from the history all together.

Ayodele Samuel Adebayo4y ago

Thanks for sharing this. Will be handy someday 😀

Chris Bongers4y ago

Haha, I hope you never have to use it. But that day you do, it's here for you 👋

Ayodele Samuel Adebayo4y ago

😂 Chris Bongers.

I've made the mistake once, while I was writing an article and pushing the code to GitHub, I revoked the Key but didn't know about this solution.

This will come in handy when someone else asked me or a colleague makes the mistake.

It's just so nice to know this things exist on your blog 😂

James 'Dante' Midzi4y ago

I had to do this a couple of days back. Thank you for this

Chris Bongers4y ago

Happens to everyone.

I've added a small subnote: If you accidentally pushed real-world secrets to a repo, you should always revoke and regenerate them.

James 'Dante' Midzi4y ago

Thanks for that, I will definitely keep that in mind.

Vishwajeet Raj4y ago

This is gold, thanks for sharing.

Chris Bongers4y ago

Glad you like it Vishwajeet! 🎉

Looking to get into development? As a full-stack developer I guide you on this journey and give you bite sized tips every single day 👊

I'm sure this happens to everyone sometimes. You accidentally pushed a file with secrets or a password that shouldn't have gotten into the Git history.

In the following example, I "accidentally" pushed my .env file to Git simply because I forgot to add it to me .gitignore file.

Removing a secret file from Git history

Note: If you accidentally pushed secret keys to a repo, you should always revoke them and generate fresh keys!

Removing the file right away

The best thing to do now is to remove the file right away and add it to your .gitignore file.

In my case, I added the following to the .gitignore.

# Secret file
.env

Let's try and push that to see what happens.

Gitignore doesn't work on existing files

Yep, the .gitignore file doesn't untracked already committed changes. So how can we fix this now?

Removing a file from Git only

You can remove a file from Git by running the following command.

git rm -r --cached .env

If we then push this change, you will see that the file is gone in GitHub.

Removing a file from Git

However, this didn't completely solve our issue. If we look at our Git history, we can still find the file and expose the secrets!

Exposing secrets through Git history

Completely remove a file from Git history

To remove the file altogether, we can use the following command.

git filter-branch --index-filter "git rm -rf --cached --ignore-unmatch .env" HEAD

You will get some warnings about this messing up your history as this goes through your whole history and 100% removes its occurrence.

To push this, you have to run the following command.

git push --force

If we look at our history, we can still see the commits that include this .env file, but the content is empty.

Fully removed file in Git

Few, thanks for having our back Git!

You can find the repo it tried this in on GitHub.

Thank you for reading, and let's connect!

Thank you for reading my blog. Feel free to subscribe to my email newsletter and connect on Facebook or Twitter

Removing a .env file from Git history

Comments (4)

Git basics

Git basics: Help my case-sensitive filename changes don't commit

More from this blog

I wrote 1000 articles, what’s next?

Vendure community and more

Deploying Vendure

Vendure - Overwriting email templates

Customizing vendure

Removing the file right away

Removing a file from Git only

Completely remove a file from Git history

Thank you for reading, and let's connect!

Command Palette

Comments (4)

Git basics

Git basics: Help my case-sensitive filename changes don't commit

More from this blog

Removing the file right away

Removing a file from Git only

Completely remove a file from Git history

Thank you for reading, and let's connect!