Question

I have a project on GitHub behind a private repository. I want to make the repo public. However, my project uses secret keys.

How can I make the project public while still protecting the “history” of those secret keys? I’m guessing I’m SOL, and should simply invalidate the keys to prevent their use.

Note that this is not the same question as
How to open-source an application that uses API keys

or

How to handle 'open-sourcing' your application, when it uses a personal API key?

As my project is already on Git, the entire source history can be easily viewed. What I suppose I could do is branch off a separate project with the API keys hidden, and make that repo public. But then users would miss out on the entire branching history, which they may be curious about (I know I would).

Answer 1

You could remove the secret keys using the git-filter-repo tool, see this explanation in the GitHub documentation.

git-filter-repo is much preferable to the older git filter-branch.

---

My old, now somewhat out-of-date answer:

You could remove the secret keys from the repository using a hammer like git filter-branch. There is a nice explanation on GitHub’s help pages.