Why Removing a Secret From Git Does Not Actually Remove It — and What That Means for Storage

A developer puts a database password in a config file, commits it to the repository, and moves on. The password is now in version control permanently — not just in the current state, but in every commit that follows, every clone ever made, every fork that existed before the file was removed. Deleting the file does not remove it. The only remediation is a destructive history rewrite that most teams never complete. That is one storage decision, made in thirty seconds, with a consequence that may never fully go away. How secrets get stored determines not just who can access them today but who might reach them at any point in the future.

This video maps the full storage spectrum — from plaintext in repositories at the weak end, through environment variables and their widely misunderstood security properties, to dedicated secrets managers and the specific failure mode they introduce. Environment variables relocate secrets rather than protecting them, and in containerised environments with logging agents and observability tooling, secrets passed as environment variables routinely arrive in log aggregation systems whose access controls are far looser than the application. This pattern — a secret moving from a controlled location into a less controlled one through infrastructure doing exactly what it was designed to do — is consistent enough across real breaches to have a name: secret laundering.

The secret zero problem introduced here — every secrets manager requires a first credential that must itself be protected — runs through the rest of the series as a reminder that every abstraction shifts the problem rather than eliminating it. The question worth carrying out of this video is not where a secret is stored, but everywhere it has ever been — and whether any of those places have access controls that match what the secret actually protects.

Видео Why Removing a Secret From Git Does Not Actually Remove It — and What That Means for Storage канала Security Explained