Remove Sensitive Data from GitHub

In this tutorial we are going to be using nix-shell so we do not have to install any dependencies on our machines.

1. Run the below command to start a nix-shell with the needed tools.

nix-shell -p openjdk17-bootstrap git bfg-repo-cleaner

1. Once inside the nix-shell clone the repo with the --mirror command.

git clone --mirror https://github.com/org/reponame.git

1. Create a passwords.txt file containing all sensitive data that needs to be removed from the repository.

nano passwords.txt

1. Run the command to remove the passwords from git history.

bfg --replace-text passwords.txt reponame.git

1. cd into the repo directory and force git to push back to github.

cd reponame.git
git push --force

1. cd back out of the directory and delete the repo folder and passwords.txt file. You will be left with a .bfg-report you can use to see what was changed. This can be deleted as well once done.

If any sensitive data was included inside of a PR you will need to open a ticket with github asking them to remove the PR data from there end.

More information can be found here: Removing sensitive data from a repository - GitHub Docs