AskVibeMarked as helpful by the asker
Deleting in a new commit does nothing; the keys are in history. Two steps, today: rotate every key in that file (Supabase, Resend, Stripe), then add .env* to .gitignore and git rm --cached .env.local. Rewriting history is optional once the keys are dead. And never say 'commit everything' again; say 'commit the files you changed'.
Rotated Supabase, Resend and Stripe. Took 40 minutes. sam_builds · edited
Is it worth rewriting history too? sam_builds · edited
For a private repo, rotating is what matters. git filter-repo if you want it clean, but the old keys are dead anyway. lena_ops · edited
Did the same last year. GitHub secret scanning emailed me before I noticed. nightshiftbuilder · edited