Some weeks ago I accidentally committed a configuration file containing some passwords and I pushed it on a GitLab remote managed by my company.
After that I used BFG Repo-Cleaner to remove the passwords from the history.
After the clean I executed:
git reflog expire --expire=now --all && git gc --prune=now --aggressive git push --force
I seen the commit hashes have been changed and sensitive data has been removed (I can see that both using the GitLab web interface or exploring a new clone of the repo).
However, if I access one of the old pages calling directly the URL (
https://<my-company>/gitlab/test-bfg/commit/<theoretically-unexisting-hash>) I can see a gitdiff of a commit containing the passwords! I discovered this accidentally, navigating on the browser history.
If I try to checkout the same hash on the just cloned repo I obtain this message:
fatal: reference is not a tree: d7fb999c...
So, if a person clone that repo from GitLab I think he or she is not able to view that commit*, however it is still visible from the web interface, if one could guess an old hash.
* Anyway, I I would feel more comfortable reading
did not match any file(s) known to git instead of
reference is not a tree.
I don't think this is a kind of cache problem, because I tried it again after some hours.
So, questions are:
- Why this happens? Am I using the tools in the wrong way?
- There are some ways to see that hidden hashes?
- Did you ever experienced this, maybe using different systems (GitHub, BitBucket)?
Thank you very much.