Remove .env from Git History: Complete 6-Step Guide

Last week I accidentally committed a .env file to a GitHub repository. If you have ever done this, you know the feeling. Removing the file from the latest commit is easy, but that does not solve the real problem. The file still exists in the repository history and can be recovered by anyone who knows how to look.

This guide walks through the exact process I used to permanently remove a .env file from the entire Git history, safely, with backups, and with proper verification at the end.

By the end, you will know how to do this confidently without guessing or hoping it worked.

The Problem: git rm Is Not Enough

If you run:

git rm --cached scripts/toolkit/.env.toolkit
git commit -m "Remove env file"

You only remove the file from future commits. Every previous commit still contains the file and its contents. If secrets were inside, they are still exposed.

To truly remove a file from history, you must rewrite Git history.

This sounds scary, but done correctly, it is safe and controlled.

Step 1: Create a Full Backup of the Repository History

Before touching history, create a backup that you can restore from if anything goes wrong.

git clone --mirror https://github.com/USERNAME/REPO.git ad-art-backup.git

This creates a bare mirror containing every commit, branch, and tag. You can restore the repository to its original state from this backup at any time.

Do not skip this step.

Step 2: Create a Clean Mirror for History Rewriting

Now create a separate mirror that you will actually modify.

git clone --mirror https://github.com/USERNAME/REPO.git ad-art.git
cd ad-art.git

This mirror has no working files. It only contains Git objects, which makes it ideal for history rewriting.

Step 3: Remove the File from All Commits Using git filter-repo

Install git filter-repo if you do not already have it.

Then run:

git filter-repo --path scripts/toolkit/.env.toolkit --invert-paths

This command rewrites every commit and removes that file wherever it appears.

You will see output indicating that history was rewritten and the repository was repacked. That is expected.

During this process, Git deliberately removes the origin remote to prevent accidental force pushes.

Step 4: Re Add the Remote and Force Push

Add the remote back:

git remote add origin https://github.com/USERNAME/REPO.git

Now push the rewritten history to GitHub:

git push --force --all origin
git push --force --tags origin

This replaces the repository history on GitHub with the cleaned version.

This is the only destructive step, which is why the backup matters.

Step 5: Verify the File Is Truly Gone

Do not rely on search results or assumptions. Verify explicitly.

Check that the file never appears in history

git log --all -- scripts/toolkit/.env.toolkit

This command should return nothing.

Strong verification across all commits

git rev-list --all | while read c; do git ls-tree -r --name-only $c | grep -x "scripts/toolkit/.env.toolkit" && echo FOUND; done

If nothing prints, the file does not exist in any commit.

Be careful not to confuse this with .env.toolkit.example. Example files are safe and should remain.

Step 6: Clean Up and Prevent Future Mistakes

You can now delete the working mirror:

cd ..
rm -rf ad-art.git

In your normal working repository, add the file to .gitignore:

scripts/toolkit/.env.toolkit

Commit this change normally.

If the file ever contained secrets, rotate them. History rewriting prevents future access but does not undo past exposure.

A Note on Staged Changes and git rm --cached

If you still see the file in staged changes during cleanup, this is normal. The correct flow is:

git restore --staged scripts/toolkit/.env.toolkit
git rm --cached scripts/toolkit/.env.toolkit
git commit -m "Remove .env.toolkit from git tracking"

This removes the file from tracking while keeping it locally.

Conclusion

Accidentally committing a .env file is common, but fixing it properly requires more than a simple delete. By creating a backup, rewriting history with git filter-repo, force pushing carefully, and verifying the result, you can fully remove sensitive files from a repository.

You now know how to safely remove a file from the entire Git history and confirm that it is truly gone.

Let me know in the comments if you have questions, and subscribe for more practical development guides.

Thanks, Matija