Leaked credential

2 snippets across 2 stacks — Docker, Git

Also written as leaked credentials

DKDocker

Baking Secrets into Images

syntax

# NEVER do this:
ENV DATABASE_URL=postgres://user:pass@host/db
COPY .env /app/.env

example

# Bad — secret is in the image layer history:
ENV API_KEY=sk-abc123...

# Fix — pass secrets at runtime:
docker run -e API_KEY=sk-abc123 myapp:1.0
docker run --env-file .env myapp:1.0

# For build-time secrets (e.g., private npm token):
docker build --secret id=npmrc,src=.npmrc .
# In Dockerfile:
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci

Note ENV values and COPYed files are permanently visible via docker history and docker inspect. Even if you delete them in a later layer, they exist in the previous layer. Use --secret mounts for build-time secrets and runtime env vars or secret managers for runtime secrets.

GitGit

Accidentally Committed a Secret

Git · Common Mistakes & Recovery

syntax

git filter-repo --invert-paths --path <secret-file>
# Then: rotate the credential immediately

example

# Step 1: ROTATE THE SECRET IMMEDIATELY
# (It's in the remote history even if you delete it)

# Step 2: Remove from all history:
pip install git-filter-repo
git filter-repo --invert-paths --path .env

# Step 3: Force push the rewritten history:
git push --force --all

# Step 4: Tell all collaborators to re-clone

Note CRITICAL: Even if you delete the file in a new commit, the secret is still in the Git history and anyone can find it. The FIRST thing to do is rotate/revoke the compromised credential. Rewriting history with filter-repo is step two. GitHub also has a 'secret scanning' feature that alerts you.