A DevOps engineer commits a database password to a public GitHub repository inside a .env file, then deletes it in the next commit. Is the secret still exposed?

• A.Yes - git history preserves all previous commits. The secret is permanently in the git history and can be retrieved with 'git log' or 'git show'. Anyone who clones the repository can access all previous commits. The secret must be rotated immediately and treated as compromised
• B.No - the deleting commit removes the file from every branch of the repository history. Forks and clones fetch only the latest snapshot since Git keeps one tree per branch and the secret needs no rotation once the push completes on the GitHub servers for every contributor of the project
• C.Yes - GitHub keeps deleted files for 30 days in a cache and then purges them from all mirrors. The secret becomes harmless after that window since the credential expires with the cache and rotation is optional for the team after the repository owner confirms the cleanup in the settings page of the project