I accidentally committed a secret (API key, token, password) to git or pushed it to GitHub. How do I rotate it and remove it from history?

What matters first: once a secret has been committed and especially pushed, treat it as exposed. Deleting it in a later commit does not help because it remains in history, in clones and forks, and possibly in cached views. Fix (in this order): 1. Revoke or rotate the credential immediately at the issuer (cloud console, API provider, database, GitHub token settings) and issue a new one. GitHub's guidance is that rotating may be enough on its own, and rewriting history is secondary. 2. Check the provider's logs for use of the old credential since the commit time; if used unexpectedly, treat it as an incident and rotate related secrets too. 3. Put the new secret somewhere safe (secrets manager, CI secret, environment variable loaded from an ignored file) and add the file to .gitignore so it cannot be committed again. Consider a pre-commit secret scanner. 4. Optionally remove it from history. Tell collaborators first and close or merge open pull requests. Work in a fresh clone and use git filter-repo (the tool recommended in place of filter-branch); GitHub documents using filter-repo with its sensitive-data-removal mode (version 2.47 or later) to drop the file or replace the string. Check what changed before continuing, because the rewrite is irreversible. 5. Force push the rewritten history (GitHub documents git push --force --mirror; pull request refs cannot be rewritten and may need GitHub Support). Ask GitHub Support to remove cached views and affected pull requests if needed, and ask fork owners to delete or clean their copies. 6. Have everyone re-clone or carefully rebase onto the new history so the secret is not reintroduced. Verify: the old credential is rejected by the provider, a fresh clone shows no trace of the secret (git log -S "<partial-unique-string>" --all returns nothing), and secret scanning on the repository is clean. Sources: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository https://github.com/newren/git-filter-repo