To a local repository I accidentally committed a file whit a password in it that should not go out to the public (it was there for a lazy testing purpose...).

I saved the file again whit out the password and used git commit --amend to commit the file again. Is the password now gone for good or can it still be found some where in the repository?

1 Answer 1


If you haven't performed a git push to a remote repository before doing amending, then the commit is not available in that remote repository. It will not be pushed in the future, either.

However, your local repository still contains the old commit which you can see by running git reflog.

The actual (old) commit can then be shown with a command like:

git show HEAD@{1}

(assuming that you committed something and then amended it without further commits / branch switching)

To get rid of that commit locally, you should have a look at git gc. When you run it as-is, it will remove older, dangling commits with a certain age.

  • Thanks. Knowing it doesn't leaf my local repository is the main thing. But when I try to remove it local whit "git gc --aggressive --prune=2013-04-22" it didn't remove it. I also tried it after I used "git reflog delete abcdef" to remove it from the reflog. But "git show abcdef" still shows the password. Any suggestion to continue?
    – Den
    Apr 22, 2013 at 10:00
  • 2
    git reflog expire --all --expire-unreachable=0 && git gc --aggressive --prune=now works for me. Credits to ducea.com/2012/02/07/…
    – Lekensteyn
    Apr 22, 2013 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.