remove-secrets

Permanently purges sensitive files from the entire Git history.

Usage

git-wrangler remove-secrets

This command takes no arguments.

What it does

Permanently purges files containing sensitive data from the entire Git history of all managed repositories (across all branches and tags). Scans for common secret file patterns and removes any matches using git-filter-repo. The remote origin URL is automatically restored after the rewrite.

Target patterns

The following patterns are scanned and removed if found in history:

PatternDescription
.env, .env.*Environment variable files
*.pem, *.keyTLS/SSL certificates and private keys
*.p12, *.pfxPKCS#12 certificate stores
id_rsa, id_rsa.pubRSA SSH keys
id_ed25519, id_ed25519.pubEd25519 SSH keys
config.jsonConfiguration files
secrets.json, credentials.jsonSecret stores
*.secretSecret files

Prerequisites

  • git-filter-repo must be installed

Example

git-wrangler remove-secrets

Notes

Warning: This permanently rewrites Git history. You will need to force-push to update remotes, and all collaborators must re-clone.

  • The command scans history first and reports found files before removing them
  • Repositories with no matching patterns are skipped cleanly
  • Remote origin is preserved and restored after the rewrite