Topic starter
15/10/2026 10:09 am
TL;DR: Truffle Security’s analysis shows that force-pushed GitHub history still leaves dangling commits accessible, with tens of millions of hidden commits and 3.68 unique dangling commits found per zero-commit force push in a 1,500-repository survey. History rewriting does not equal secret removal, so detection and preventative controls have to move upstream into commit hygiene and CI enforcement.
Editorial analysis by NHI Mgmt Group, based on content published by Truffle Security: “How to Scan Force Pushed Commits for Secrets”.
By the numbers:
- Truffle Security surveyed 1,500 repositories and found 3.68 unique dangling commits per zero-commit force push.
- Truffle Security says it has seen 15 million zero-commit force push events in the dataset.
Key questions
Q: What should teams do first when a secret has already been committed to Git history?
A: Revoke or rotate the secret immediately and treat the credential as compromised, even if the bad commit has been removed from the latest branch.
Q: Why do force-pushed commits still matter after developers think they deleted them?
A: Because a force push moves the branch pointer, but it does not guarantee that the old objects are gone.
Q: How should security teams reduce the risk of exposed hardcoded secrets in source repositories?
A: Security teams should combine automated secret scanning, repository visibility monitoring, and enforced code review controls.
Practitioner guidance
- Scan dangling commits, not only live branches Extend secret scanning to commit objects that are no longer reachable from current branch heads, especially after force pushes and history rewrites.
- Treat secrets in Git as revocation failures When a secret is discovered in history, rotate or revoke the underlying credential rather than assuming a rewrite removed the exposure.
- Gate force pushes on protected repositories Restrict force pushes on shared and release branches, and require review or approval when history rewriting is unavoidable.
Bottom line: Force-pushed Git history can still contain usable secrets, so deleted code is not the same thing as removed exposure.
What's in the full article
Truffle Security’s full post covers the operational detail this analysis intentionally leaves for the source:
- The Force Push Scanner workflow for turning GH Archive push events into a scanable commit set
- The exact Git commands used to identify dangling commits and walk parent history
- The SQLite and BigQuery access options for the pre-built dataset
- The command-line scanning flow for dangling commit ranges in TruffleHog
👉 Read Truffle Security’s analysis of force-pushed Git history and secret exposure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/10/2026 10:12 am
Hidden Git history is now part of the NHI attack surface: The problem is no longer whether a secret was removed from the visible branch, but whether the underlying credential ever ceased to exist in accessible history. Force pushes can hide evidence without revoking the secret itself, which means the real control boundary is secret lifecycle management, not branch hygiene. Practitioners should treat repository history as a live credential exposure surface, not an archive.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between deleting a branch and revoking a leaked secret?
A: Deleting a branch removes one pointer to the data, but revoking a leaked secret invalidates the credential everywhere it exists. A deleted branch may still leave recoverable commits, pull request refs, or API-accessible history behind. Revocation is the actual security control because it cuts off use of the exposed secret even if copies remain discoverable.
👉 Read our full editorial: Force-pushed Git history still exposes secrets at scale