How to use GitGurdian

[flumadi]

Select Topic Area

Question

Body

Hi, My question is about GitGuardian, I just found out some of my repos are not secure and some i just forked to learn about some technologies and language use how do i go about this and secure the repos,I also would like to know if it's a major crisis or not

[Aredhel269]

Hy Flumadi;
It’s not necessarily a crisis, but it does require responsible action. If GitGuardian has detected secrets (like API keys, passwords, tokens, etc.) in your repositories, it’s important to remove and revoke them — even if the repos are just forks used for learning.

GitGuardian scans repositories to detect sensitive information that might have been committed by mistake, such as:

• access keys (AWS, Firebase, GitHub tokens, etc.)
• passwords or database connection strings
• .env files and similar

Even if you didn’t write the code, if your fork is public and contains secrets, it still poses a risk since anyone can see them.

What can you do now?

1. Review the GitGuardian reports

   • Check which secrets were detected and where.

2. If the secrets are yours, do the following:

   • Revoke the exposed keys or change passwords.
   • Remove the secrets from the code (not just in a new commit, but by rewriting history if necessary).

3. If the secrets are not yours (they came from the original repo):

   • You can make your fork private.
   • Or delete it if you don’t need it anymore.
   • You can also open an issue or PR in the original project to inform them about the exposed secrets.

Cleaning secrets from history (if needed)

To remove secrets from your repo’s history, you can use:

git filter-repo --path .env --invert-paths

(If you don’t have git filter-repo, you can install it from [here](https://github.com/newren/git-filter-repo)).

No need to panic. But yes, it’s something to take seriously, especially if:

• The keys are still valid
• The repository is public
• The secrets belong to services that could lead to costs or security issues

If you’re just learning and you’ve taken the steps above, you can relax.

[flumadi]

Thank you very much for your time and consideration to help me with this issue, I think for the forked repos i am going to make them private in order to secure the secrets but as for my own personal repos if i am to revoke the secrets lets say the API keys for example won't that affect the functioning of the app? or am i just not getting this right😅