remove-secrets

Permanently remove sensitive files from Git history.

Usagegit-wrangler remove-secrets [options]

Warning: This operation is intentionally not recoverable through rollback-rewrites. Make a separate backup if you may need the original history, and treat exposed credentials as compromised even after removal.

Quick start

# Review the configured path patterns first
git-wrangler config file remove-secrets show

# Scan, preview matches, and confirm removal
git-wrangler remove-secrets

What it does

remove-secrets scans every commit for configured sensitive paths, shows matches, and asks once before permanently removing them from history. Repositories without matches are skipped.

The default path list covers environment files, package credentials, private keys, certificates, SSH keys, cloud credentials, Kubernetes credentials, and common secret stores. It intentionally avoids broad names such as a generic config.json.

Configure the path list

# Show the file location
git-wrangler config file remove-secrets path

# Show the current patterns
git-wrangler config file remove-secrets show

# Edit the patterns
git-wrangler config file remove-secrets edit

The file is created with defaults the first time it is needed. Its paths list is the complete set of patterns that will be removed, so review it carefully before running the rewrite.

Before you run it

git-filter-repo is required. The command refreshes origin before scanning and stops before changing anything if that refresh fails.

After removal, rotate or revoke any exposed credentials, force-push the rewritten branches, and coordinate with collaborators who have old clones.

Options

Option Default What it does
--repo <path> Whole workspace Scan exactly one repository.
--no-fetch Off Skip refreshing origin; remote information may be old.
--yes, -y Off Skip the confirmation after matched files are shown.
--guided Off Choose options through prompts.