git-safety

# Git Safety Skill Comprehensive security scanning, cleaning, and prevention for git repositories. ## Contract Inputs: - Repository root - Mode: scan, prevent, clean, or full - Optional leaked path, secret pattern, or affected ref range Outputs: - Sensitive file/history findings - Rotation and remediation checklist - Commands required for prevention or history cleanup Creates/Modifies: - Scan mode: no file changes - Prevent mode: `.gitignore` and optional hook updates - Clean mode: rewritten git history only after explicit confirmation External Side Effects: - May force-push rewritten history in clean mode - May require credential rotation outside the repository Confirmation Required: - Before history rewriting - Before force-pushing - Before changing hooks or ignore rules in shared repos Delegates To: - `security-audit` for broader application-security review - `open-source-checker` before publishing a private repo ## CRITICAL WARNING **Removing secrets from git history does NOT make them safe!** Even after cleaning git history: - GitHub is scraped by bots within seconds of a push - Archive services may have captured snapshots - Forks retain the original history - CI/CD logs may contain the values **ALWAYS rotate leaked credentials immediately.** Cleaning history is NOT enough. ## Modes of Operation ### 1. `/git-safety scan` - Detect Sensitive Files Scan repository for sensitive files in current state and git history. ### 2. `/git-safety clean` - Remove from History Remove sensitive files using git-filter-repo or BFG. ### 3. `/git-safety prevent` - Set Up Prevention Configure .gitignore and pre-commit hooks. ### 4. `/git-safety full` - Complete Audit Run all three operations in sequence. ## Sensitive File Patterns ``` .env, .env.*, credentials.json, service-account*.json *.pem, *.key, id_rsa*, secrets.*, .npmrc, *.secret ``` ## Quick Commands **Scan for sensitive files in history:** ```bash git log --all --pretty=format: --name-only --diff-filter=A | sort -u | grep -iE 'env|secret|credential|key' ``` **Remove .env from all history:** ```bash git filter-repo --path .env --invert-paths --force git push origin --force --all ``` **Add to .gitignore:** ```bash echo -e "\n.env\n.env.*\n*.pem\n*.key\ncredentials.json" >> .gitignore ``` ## Emergency Response If you've leaked credentials: 1. **IMMEDIATELY rotate the credential** 2. Check access logs 3. Run `/git-safety clean` 4. Force push cleaned history 5. Notify team to re-clone 6. Update .gitignore 7. Set up pre-commit hooks --- **For complete scan commands, cleaning process with git-filter-repo/BFG, pre-commit hook setup, .gitignore templates, platform-specific guidance, and detailed emergency checklist, see:** `references/full-guide.md`