Secrets do not belong in Git, even private Git.
Repository privacy does not provide rotation, access scoping, or reliable erasure.
Interpretation
A committed secret travels into clones, caches, forks, logs, and backups. Deleting the line does not revoke the credential or erase its history. Keep secrets in a dedicated store, inject them at runtime, and treat every accidental commit as exposure requiring immediate rotation.
Practice
- Use secret managers and runtime injection.
- Scan commits before they reach the remote.
- Rotate exposed credentials before cleaning history.
Anti-pattern
Deleting a leaked key from the latest commit and considering it safe.