i learned this lesson, with smaller stakes
A CISA contractor exposed credentials, config files, and access tokens in a public GitHub repository. I had a smaller incident with a similar pattern — and a very different blast radius — in April.
Git
security - stage 2 - internet cache and the wayback machine
Cleaning git history removes data from your repo — but not from search engines, the Wayback Machine, or GitHub’s cache. Here is what to check.
security - stage 1 - cleaning sensitive data out of git history
After a security review flagged AWS identifiers committed to a public repo, we used git-filter-repo to scrub them from all 46 commits — including file content and commit messages.
security remediation — what we got wrong
A post-launch security review of tacedata.ca uncovered sensitive AWS identifiers committed to a public repository. This is a full account of what was exposed, how it was found, and what it took to fix it.