Can someone who clones my repo get my api_key from earlier commits?

Question

I pushed my api key to github and pushed another commit that hid it. Can someone who clones my repo get the key from the earlier commit?

Answer 1

GitHub lets everybody download the whole git repository, which contains the whole project history (meaning the state of the repo at every commit can be rebuilt). You can even read and search the history online without cloning.

So yes, it's easy to find what you thought you deleted (you can have fun yourself searching for such removed keys in other repositories).

But this is a common enough problem, and there are solutions. That's why GitHub came with a permanent page helping you deal with the "oops I commited the API key" moment: https://help.github.com/en/articles/removing-sensitive-data-from-a-repository

Note that it doesn't take a lot of time to have a key (automatically) noticed. So if the API key or password is important, your first step should be to change your password or disable the key.