Fix: GH013 Push cannot contain secrets (GitHub push protection)

The push fails with 'remote: error: GH013: Repository rule violations found' and a line reading 'Push cannot contain secrets', followed by the secret type, the commit id and the file path and line. Nothing reached GitHub. GitHub's docs are clear on the resolution: you must remove the secret from all of the commits it appears in. Deleting it in a new commit is not enough, because the earlier commit still carries it.

• A key was pasted directly into source code while prototyping, often by an AI tool filling in a working example.
• A .env file was committed because .gitignore was missing, or was added after the file was already tracked.
• A config, notebook, test fixture or log file containing a token was added with git add .
• You removed the secret in a later commit, but the original commit is still in the branch you are pushing.

1. 1Read the error. Note the commit id and file path for each detected secret.
2. 2Rotate first if the key has left your machine in any way: a previous push to any remote, a shared zip, a chat, a paste into an AI tool. If you are unsure, rotate. It takes minutes.
3. 3Move the value into an environment variable and add the file to .gitignore.
4. 4If the secret is in your latest commit only: remove it from the file, then run git commit --amend --all and push.
5. 5If it is in an older commit: run git log to find the earliest commit that contains it, start git rebase -i <COMMIT-ID>~1, change pick to edit for that commit, remove the secret, run git add . then git commit --amend, then git rebase --continue, and push.
6. 6If a .env file was tracked, untrack it with git rm --cached .env as part of the amended commit.
7. 7If the secret did reach GitHub earlier, for example before push protection was on, follow GitHub's guide to purge it from history with git filter-repo after rotating.

git rm --cached .env
echo '.env' >> .gitignore
git add .gitignore
git commit --amend --all
git push

git log --oneline
git rebase -i COMMIT_ID~1
git add .
git commit --amend
git rebase --continue
git push

Before pushing, search every commit on your branch for the start of the key. The command should print nothing. Then push: a clean push is the final confirmation. Afterwards, check the Security tab of your own repository for open secret scanning alerts.

git log -p --all -S 'FIRST_12_CHARS_OF_THE_KEY' --oneline

git ls-files | grep -E '^\.env'