github-publishlisted

# GitHub Publish Publishing is irreversible. A secret pushed to a public repo is compromised the moment it lands, and deleting the commit does not un-compromise it — it is already in forks, mirrors, and scrapers within minutes. So the sweep comes first, every time, and the push is the last step. ## Step 1 — Secret sweep, before anything else **The working tree is not enough. Check the full history.** ```bash # every file ever committed that looks like a secret carrier git log --all --name-only --pretty=format: | sort -u | grep -iE '\.env|\.pem$|\.key$|id_rsa|credentials|secrets?\.(ya?ml|json)' # high-signal patterns across all history git grep -nE '(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----)' $(git rev-list --all) 2>/dev/null | head -20 # working tree grep -rnE '(api[_-]?key|secret|password|token)\s*[=:]\s*["\x27][^"\x27]{12,}' . --exclude-dir=.git --exclude-dir=node_modules | head -20 ``` A dedicated scanner such as `gitleaks detect --no-git=false` is worth running as well. Do not rely on it alone; do not skip it either. **If the history is dirty, it must be rewritten or the repo re-initialised before pushing.** There is no "we'll clean it up after" option here. Then confirm: - `.env` is gitignored, and only `.env.example` with empty labelled keys is public - Code reads keys from the environment. No hardcoded credentials anywhere - A `.gitignore` appropriate to the language exists at all ## Step 2 — Harden what t