2026-10-30 · Daily security tips

Is an old API key still sitting in your git history?

AI builders often sync your project to GitHub. If a secret key was ever committed, removing it in a later commit only hides it from the latest version. Every earlier commit still contains it.

Check: is the repo public? Then run git log -p -S "sk_" in your project folder, and repeat for service_role, api_key and secret. Any hit in an old commit means the key is in history.

Fix: rotate the key first in the provider's dashboard. That is the step that actually protects you. Then move it to server-side environment variables, add .env to .gitignore, and turn on GitHub secret scanning and push protection if they are available for your repo.

Rewriting history is optional once the key is dead.