How to Stop Secrets From Reaching GitHub Repositories

Prevent secrets from reaching GitHub using layered controls.

Architecture

Developer -> Pre-commit -> Pull Request -> CI Scan -> Repository

Secret Types

Cloud credentials, API keys, database passwords, private keys, OAuth secrets, and service tokens.

Local Scan

gitleaks detect --source .

CI Scan

Repeat scanning centrally because local controls can be bypassed.

Secure Storage

Use a proper secret manager rather than committing credentials or storing unnecessary reusable secrets in repository configuration.

If a Secret Leaks

1. Identify it.
2. Rotate or revoke it.
3. Review usage.
4. Remove exposure where appropriate.
5. Investigate.
6. Document the incident.

Deleting a Git file does not invalidate the credential.

Better Cloud Pattern

Use workload identity federation to eliminate many long-lived cloud credentials.

Final Takeaway

The strongest strategy combines prevention, scanning, secure storage, short-lived identity, monitoring, and rapid rotation.