Question

A developer accidentally committed a file containing production database credentials to the main branch of an Azure Repos Git repository three weeks ago. Several commits have been made since, and the branch is shared by 12 team members. Security requires that the secret be completely removed from the repository history, not just the latest commit. Which action correctly removes the sensitive data from all history?

Accepted Answer

Use git filter-repo (or BFG) to rewrite history removing the file, force-push the rewritten branch, and have all team members re-clone; also rotate the exposed credentials.

Answer

Delete the file in a new commit and push it to main so the credentials no longer appear in the working tree.

Answer

Enable branch policies with push protection on main so future secret pushes are blocked automatically.

Answer

Create a new tag at the current commit and delete all older tags that reference the commit containing the secret.