Secrets Committed to Git History: Discovery and Remediation

IntermediateFree5 modules · 15 lessons

About this course

A focused course on finding and fixing credentials already committed to a repository's history, distinct from ongoing secret lifecycle management. You will learn why deleting a secret from the latest commit does not remove it from history, how to scan an entire repository's history rather than just its current state, and how to prioritize findings by validity and access. The course closes with the correct remediation sequence, rotate first and evaluate history rewriting separately, plus the preventive controls and organisational posture that reduce future incidents.

What you'll learn

Foundations: Why a Deleted Secret Is Not a Gone Secret

Why Git History Keeps Every Secret You Ever Committed
How Secrets End Up Committed in the First Place
Scope of This Course and How It Fits Alongside Related Practices

Discovery: Finding Secrets Across the Whole History, Not Just the Tip

Why Scanning Only the Current Working Tree Misses the Real Problem
How History-Wide Secret Scanning Works
Reading Scan Results: Separating Real Findings From Noise

Triage: Prioritizing What Discovery Found

Is the Secret Still Valid? Live Versus Dead Credentials
What Does This Secret Grant? Scoping the Blast Radius
Building a Prioritized Remediation Queue

01Foundations: Why a Deleted Secret Is Not a Gone Secret3 lessons

Why Git History Keeps Every Secret You Ever Committed
How Secrets End Up Committed in the First Place
Scope of This Course and How It Fits Alongside Related Practices

02Discovery: Finding Secrets Across the Whole History, Not Just the Tip3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Remediation: Rotate First, Then Decide About History

Rotation Is the Only Action That Actually Closes the Exposure
The Remediation Sequence: Rotate, Notify, Then Decide on History
Rewriting Git History: What It Actually Does and What It Costs

Prevention and the Human Response

Pre-Commit Hooks and Push-Time Scanning as Prevention
What To Do the Moment You Realize You Committed a Secret
Organisational Policy: Making the Fast, Calm Report the Easy Choice

Why Scanning Only the Current Working Tree Misses the Real Problem

How History-Wide Secret Scanning Works

Reading Scan Results: Separating Real Findings From Noise

03Triage: Prioritizing What Discovery Found3 lessons

Is the Secret Still Valid? Live Versus Dead Credentials
What Does This Secret Grant? Scoping the Blast Radius
Building a Prioritized Remediation Queue

04Remediation: Rotate First, Then Decide About History3 lessons

Rotation Is the Only Action That Actually Closes the Exposure
The Remediation Sequence: Rotate, Notify, Then Decide on History
Rewriting Git History: What It Actually Does and What It Costs

05Prevention and the Human Response3 lessons

Pre-Commit Hooks and Push-Time Scanning as Prevention
What To Do the Moment You Realize You Committed a Secret
Organisational Policy: Making the Fast, Calm Report the Easy Choice

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.