World 11: Rescue Center

I pushed a password

You will learn: what to do first when a secret reaches GitHub.

The problem

~/diary $ git show --statcommit fdb9663813b59a2456c728da97e6d8f75a2613d6 (HEAD -> main, origin/main)Author: You <you@example.com>Date:   Fri Oct 30 09:04:00 2026 +0800    Add weather widget .env   | 1 + app.js | 3 +++ 2 files changed, 4 insertions(+)

You pushed. Then you spot it: .env holds your secret key. And it’s on GitHub now. Breathe. This happens to everyone. Here’s the safe way out.

Try it

What do you do first?

Watch

The key is rotated. Now clean up. git rm --cached .env tells Git to stop tracking the file. It stays on your computer.

Try it

Stop tracking .env. Add it to .gitignore. Commit and push.

Working folder

Empty

Staging area

Empty

Repository

4 save points
Add weather widget
Add style
Add day 1 page

Hint

Type git rm --cached .env, then echo ".env" >> .gitignore, then git add .gitignore. Then commit and push.

Predict

Your newest commit has no .env. Is the key gone from GitHub?

Check

Good move, or needs work? Swipe each one.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Rotate the key before anything else

You did it!

You can now handle a pushed secret: rotate first, then clean up.

Go deeper (optional)

Not pushed yet? Nobody saw it. Untrack and ignore .env, then run git commit --amend --no-edit. Pushed? Wiping the key from every old commit takes git filter-repo. World 8’s lesson “Leaked a key? Rotate first” shows how. GitHub’s push protection can block some secrets before they leave.