CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A DevOps engineer commits a database password to a public GitHub repository inside a .env file, then deletes it in the next commit. Is the secret still exposed?
- A.No - deleting the file in the next commit removes it from the repository
- B.Yes, but only for 24 hours before GitHub purges the commit history
- C.The secret is only accessible if someone cloned the repository before the deletion
- D.Yes - git history preserves all previous commits. The secret is permanently in the git history and can be retrieved with 'git log' or 'git show'. Anyone who clones the repository can access all previous commits. The secret must be rotated immediately and treated as compromised
Why D is correct
Git is an append-only ledger - deleting a file in a new commit doesn't erase it from history. Every previous commit is permanently stored and accessible via git log, git checkout <hash>, or git show. GitHub also crawls pushed commits and services like GitGuardian monitor public repos for secrets in real-time. When a secret is committed to a public repo, assume it is immediately compromised. Required actions: rotate the secret, purge git history (git filter-branch/BFG Repo Cleaner), force-push (if feasible), and audit access logs.
Know someone studying for Web App Fundamentals? Send them this one.