Content
@
https://opensea.io/collection/dev-21
0 reply
0 recast
2 reactions
sudo rm -rf --no-preserve-root /
@pcaversaccio
Suppose u have accidentally pushed a `.env` file into ur repo. You immediately hit `git reset --hard HEAD^ && git push origin -f`. Now u feel safe again. WRONG! GitHub DOES NOT DELETE FORCED-PUSHED COMMITS! All dangling commits can be retrieved via GH's API endpoint `PushEvents`.
1 reply
1 recast
4 reactions
sudo rm -rf --no-preserve-root /
@pcaversaccio
To be clear, before posting the screenshot above, I verified that none of the dangling commits pose any security risk. You can read more about it here: https://neodyme.io/en/blog/github_secrets. And the repo is here: https://github.com/neodyme-labs/github-secrets.
1 reply
0 recast
0 reaction
sudo rm -rf --no-preserve-root /
@pcaversaccio
Furthermore, this is also the case if you change your repository setting from private to public. The events endpoint still lists all `PushEvents` even from the time it was private and the hash of any incorrect commit can still be seen there.
0 reply
0 recast
0 reaction
