# Git Safety

> Scans, cleans, and prevents secrets in git history across four modes: scan (detect sensitive files in the current state and history), clean (rewrite history to remove secrets using git-filter-repo or BFG), prevent (add .gitignore and pre-commit hooks), and full (all three in sequence). Use when the user asks to check for leaked credentials, scrub a secret from git history, force-push a cleaned repo, set up pre-commit secret prevention, or run a full git security audit.

- Skill: `shipshitdev/git-safety-2` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add shipshitdev/git-safety-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/shipshitdev/git-safety-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: shipshitdev (https://skillmd.com/u/shipshitdev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/shipshitdev/git-safety-2

---


# Git Safety Skill

Comprehensive security scanning, cleaning, and prevention for git repositories.

## Contract

Inputs:

- Repository root
- Mode: scan, prevent, clean, or full
- Optional leaked path, secret pattern, or affected ref range

Outputs:

- Sensitive file/history findings
- Rotation and remediation checklist
- Commands required for prevention or history cleanup

Creates/Modifies:

- Scan mode: no file changes
- Prevent mode: `.gitignore` and optional hook updates
- Clean mode: rewritten git history only after explicit confirmation

External Side Effects:

- May force-push rewritten history in clean mode
- May require credential rotation outside the repository

Confirmation Required:

- Before history rewriting
- Before force-pushing
- Before changing hooks or ignore rules in shared repos

Delegates To:

- `security-audit` for broader application-security review
- `open-source-checker` before publishing a private repo

## CRITICAL WARNING

**Removing secrets from git history does NOT make them safe!**

Even after cleaning git history:

- GitHub is scraped by bots within seconds of a push
- Archive services may have captured snapshots
- Forks retain the original history
- CI/CD logs may contain the values

**ALWAYS rotate leaked credentials immediately.** Cleaning history is NOT enough.

## Modes of Operation

### 1. `/git-safety scan` - Detect Sensitive Files

Scan repository for sensitive files in current state and git history.

### 2. `/git-safety clean` - Remove from History

Remove sensitive files using git-filter-repo or BFG.

### 3. `/git-safety prevent` - Set Up Prevention

Configure .gitignore and pre-commit hooks.

### 4. `/git-safety full` - Complete Audit

Run all three operations in sequence.

## Sensitive File Patterns

```
.env, .env.*, credentials.json, service-account*.json
*.pem, *.key, id_rsa*, secrets.*, .npmrc, *.secret
```

## Quick Commands

**Scan for sensitive files in history:**

```bash
git log --all --pretty=format: --name-only --diff-filter=A | sort -u | grep -iE 'env|secret|credential|key'
```

**Remove .env from all history:**

```bash
git filter-repo --path .env --invert-paths --force
git push origin --force --all
```

**Add to .gitignore:**

```bash
echo -e "\n.env\n.env.*\n*.pem\n*.key\ncredentials.json" >> .gitignore
```

## Emergency Response

If you've leaked credentials:

1. **IMMEDIATELY rotate the credential**
2. Check access logs
3. Run `/git-safety clean`
4. Force push cleaned history
5. Notify team to re-clone
6. Update .gitignore
7. Set up pre-commit hooks

---

**For complete scan commands, cleaning process with git-filter-repo/BFG, pre-commit hook setup, .gitignore templates, platform-specific guidance, and detailed emergency checklist, see:** `references/full-guide.md`