Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To a local repository I accidentally committed a file whit a password in it that should not go out to the public (it was there for a lazy testing purpose...).

I saved the file again whit out the password and used git commit --amend to commit the file again. Is the password now gone for good or can it still be found some where in the repository?

share|improve this question
up vote 6 down vote accepted

If you haven't performed a git push to a remote repository before doing amending, then the commit is not available in that remote repository. It will not be pushed in the future, either.

However, your local repository still contains the old commit which you can see by running git reflog.

The actual (old) commit can then be shown with a command like:

git show HEAD@{1}

(assuming that you committed something and then amended it without further commits / branch switching)

To get rid of that commit locally, you should have a look at git gc. When you run it as-is, it will remove older, dangling commits with a certain age.

share|improve this answer
Thanks. Knowing it doesn't leaf my local repository is the main thing. But when I try to remove it local whit "git gc --aggressive --prune=2013-04-22" it didn't remove it. I also tried it after I used "git reflog delete abcdef" to remove it from the reflog. But "git show abcdef" still shows the password. Any suggestion to continue? – Den Apr 22 '13 at 10:00
git reflog expire --all --expire-unreachable=0 && git gc --aggressive --prune=now works for me. Credits to… – Lekensteyn Apr 22 '13 at 12:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .