Detecting and Removing Secrets from Git History with Betterleaks and git-filter-repo
Have you ever wondered exactly what has entered your Git repository over time? Accidental commits of debug functions, incorrect comments, or copied files can usually be fixed with a follow-up commit. However, when sensitive data such as third-party service keys, integration credentials, database dumps, or entire /private/uploads directories are involved, simply committing a deletion does not remove the information from history.
Secrets committed to any repository, even a private one, remain accessible through git log or by checking out older commits. Anyone who can read the repository, clone it, fork it, or access connected CI/CD pipelines gains exposure. Contracts with clients frequently prohibit storing credentials or sensitive data in repositories for this reason, emphasizing the need for traceable password issuance and revocation processes.
The first step is to scan the repository thoroughly. The recommended tool is Betterleaks, which replaced earlier utilities such as gitleaks. It applies rule-based detection for patterns resembling AWS keys or GitHub tokens, uses BPE tokenization to reduce false positives, and automatically decodes Base64, hex, and URL-encoded content. Installation is available via Homebrew, Docker, or source build.
Running betterleaks git . --log-opts="--all" -v examines every commit, patch, and change across all branches. Results include details such as the rule ID, matched secret, author, commit message, and file path. Reports can be exported in JSON format for further processing. Manual review of findings is essential to distinguish real secrets from false positives.
After confirmation, git-filter-repo is used to rewrite history. Secrets extracted from the report are converted into replacement rules, and files matching dangerous extensions such as .sql, .env, or .bak are listed for removal. Before execution, secrets must be moved to external configuration files such as .env.local or settings.local.php so the application continues to function after cleanup.
The procedure is destructive and irreversible. A mirror backup must be created, all pull requests closed, and a clean clone prepared. The command git filter-repo --invert-paths --paths-from-file paths-to-remove.txt --replace-text secrets-to-replace.txt performs both file deletion and secret replacement in one pass. After verification with a new scan, aggressive garbage collection and a forced mirror push complete the process.
Every contributor and CI/CD pipeline must then perform a fresh clone rather than a pull or rebase, because commit hashes have changed. Even after these steps, old objects may survive in forks, backups, or caches, making secret rotation mandatory.
Related articles
Dropbox Lenovo ID Integration Flaw Exposes Thousands of Accounts Without Passwords
A flaw in the federated authentication process between Dropbox and Lenovo ID allowed attackers to compromise approximately 5,000 accounts between August 4 and August 21, 2026. Attackers registered a Lenovo ID using the email address tied to an existing Dropbox account due to missing email verification checks. They then logged in via the Lenovo ID option, and Dropbox automatically associated the identity with the existing account without requiring the original Dropbox password. Only accounts linked to the Lenovo ID integration and lacking two-factor authentication were affected. In fewer than one-third of the compromised accounts, attackers viewed or downloaded stored files. Dropbox responded by terminating all Lenovo ID sessions, removing existing associations, and updating the login flow to require the Dropbox password. Lenovo described the issue as stemming from a legacy integration and stated that its own customers were not directly impacted.
Yellow Hat Reports Breach in Web Work Reservation System, Possible Leak of 1.8 Million Member Records
Japanese automotive retailer Yellow Hat disclosed that its Web Work Reservation System was compromised, potentially exposing personal data of up to 1,801,499 members. The intrusion was detected on August 18, 2026, after which investigators confirmed that customer information stored on the company's member server may have been exfiltrated. Affected records include names, telephone numbers, email addresses, and member numbers. Yellow Hat has notified law enforcement and Japan's Personal Information Protection Commission while contacting impacted individuals through multiple channels. The company is advising members to remain vigilant against unsolicited communications that could indicate misuse of the stolen data.
Kaspersky MDR Adds Automatic Correlation with Leaked Credentials via Digital Footprint Intelligence
Kaspersky has updated its Managed Detection and Response service to automatically match security events against data from compromised logins and passwords. The enhancement integrates Kaspersky Digital Footprint Intelligence to provide analysts with additional context when suspicious activity coincides with known credential leaks. According to the company, a quarter of attacks investigated in 2025 began with the use of stolen credentials. The update also introduces notifications for asset protection status, allowing administrators to address connectivity or telemetry issues that could affect monitoring quality. Managed service providers can now configure per-client license usage limits, and the service adds support for Kaspersky Embedded Systems Security for Linux 4.0. The MDR platform continues to deliver 24/7 infrastructure monitoring, threat hunting, incident investigation, and response capabilities.
Hacktivist Group Cyberleek Leaks Alleged GTA VI Gameplay and Map Details in Protest Against Digital-Only Releases
A hacktivist collective calling itself Cyberleek has released two purported gameplay clips from GTA VI along with images that may depict the full map of Leonida state. The group claims the leak is a protest against Rockstar's decision to sell physical editions that contain only a download code rather than an actual disc. Cyberleek is also demanding an end to digital pre-orders, the practice of selling built-in content as DLC, and mandatory online connectivity for single-player modes. Rockstar and parent company Take-Two have already filed DMCA takedown requests, which some observers view as indirect confirmation of the material's authenticity. The footage reportedly shows basketball mechanics, vehicle customization, trunk-opening animations, a stamina meter, and an honor system reminiscent of Red Dead Redemption 2. The alleged map includes five counties, an extensive rail network, and numerous small islands. At the same time, Cyberleek is promoting a Solana-based token and soliciting donations, prompting several outlets to question whether the operation is partly a cryptocurrency marketing scheme.