commitdog secrets command scans your full commit history — across every branch — using the same detection patterns as the staged-diff scan, and reports anything it finds along with the commit, file, and exact line.
Run a history scan
1
Run the command
From any directory inside your Git repository, run:commitdog reads every commit hash across all branches using
git log --all.2
Wait for the scan to complete
commitdog reports how many commits it is checking, then works through each one:Scan time scales with the number of commits in your repository.
3
Review the results
If your history is clean, commitdog confirms it:If secrets are found, commitdog lists each one with the commit hash, commit subject, secret type, file, and the offending line:
What the output shows
Each finding includes:- Commit hash — the short (7-character) hash of the commit that introduced the secret
- Commit subject — the first line of the commit message, so you can identify the change
- Secret type — the category of credential detected (for example,
AWS access keyorStripe key) - File — the path to the file where the secret appears
- Offending line — the actual line content, truncated to 72 characters if longer
Removing secrets from history
Finding a secret in history means the credential is already in your remote. Rotate the credential immediately, then rewrite your Git history to remove the secret.Two tools are commonly used to rewrite Git history:
- git filter-repo — remove a specific file from all commits:
Install it from github.com/newren/git-filter-repo.
- BFG Repo Cleaner — a faster alternative for removing secrets or large files from history: rtyley.github.io/bfg-repo-cleaner