You notice it during a code review: .env is in the repository. Your stomach drops. You run git rm .env , commit with the message "remove env file", push, and feel the relief of a problem solved.

It is not solved. The file is gone from your latest commit. It is sitting, in full, in every commit before that one, and anyone who can read the repository can read it.

Why Deleting Doesn't Delete

Git is a history book. A new commit adds a page saying "the file no longer exists". It does not tear out the old pages.

git log --all --full-history -- .env

Enter fullscreen mode

Exit fullscreen mode

If that prints any commits, your file is in history. And anyone can go back to it:

git show <old-commit>:.env

Enter fullscreen mode

Exit fullscreen mode

That works for a public repository on GitHub, for a coworker's clone, for a fork, and for any tool that scans old commits.…