Commit a credential and discover why deleting it does not help

short · 40 min · Objective 5.2

Task

Prove that repository history is permanent. Commit an obviously fake credential, delete it in a later commit, and then recover it from the history -- which is exactly what an automated scanner does within minutes of a public push.

Steps

  1. Initialise a repository, commit a configuration file containing the fake string, then commit again with the line removed.
  2. Confirm the working tree is clean of it. Then recover it from history and record the exact command in lab/git/history.md.
  3. Clone the repository to a second directory and recover the string from the clone too, demonstrating that removal from one copy removes it from none.
  4. Write the correct response sequence in lab/git/response.md: rotate FIRST, then clean history if you wish -- and state why the reverse order changes nothing about the exposure.
  5. Install a pre-commit hook that refuses a commit containing the pattern, and capture the refusal in lab/git/blocked.txt.

Verify

grep -c 'NOT-A-REAL-CREDENTIAL' lab/git/history.md
grep -Eci 'clone' lab/git/history.md
grep -Eci 'rotat' lab/git/response.md
test -s lab/git/blocked.txt && grep -Eci 'block|refus|reject' lab/git/blocked.txt

All four non-zero. The rotation note must come first in the response sequence: cleaning history without rotating leaves the credential valid and merely harder to find.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.