TL;DR A committed .env file never goes away. After git rm the password is still readable with git show <commit>:.env and git log -p. The only real fix is to rotate the secret. gitleaks finds it in milliseconds. In my run it scanned 105 bytes in 24 ms and reported 2 leaks (a Stripe-style key and a generic …