Scrub Git History

Remove sensitive data from git history. WARNING: This rewrites history!

Usage

Execute the history scrubbing script:

bash "$CLAUDE_PLUGIN_ROOT/scripts/scrub-history.sh" <target> [--dry-run]

Options

• --dry-run or -n: Preview what would be removed without making changes
• target: File path, directory, or pattern to remove

Modes

File/Directory Removal

scrub-history.sh .env                # Remove .env from all commits
scrub-history.sh secrets/            # Remove entire directory
scrub-history.sh config/prod.key     # Remove specific file

Pattern Removal (requires git-filter-repo)

scrub-history.sh 'sk_live_abc123'    # Remove specific string
scrub-history.sh 'AKIA[A-Z0-9]{16}'  # Remove AWS keys by pattern

Safety Features

1. Creates backup branch before rewriting
2. Refuses to run with uncommitted changes
3. Requires explicit confirmation
4. Dry-run mode for preview

Post-Scrub Steps

After scrubbing, you must:

1. Force push: git push --force --all
2. Notify collaborators to re-clone
3. Rotate any exposed credentials!

Examples

• /scrub:history .env --dry-run - Preview removal
• /scrub:history credentials.json - Remove credentials file
• /scrub:history 'password123' - Remove specific string

Requirements

• git-filter-repo for pattern removal (install: brew install git-filter-repo)
• Standard git filter-branch works for file removal