RedactBar
How to remove secrets and API keys from .zsh_history on Mac
The exact commands to safely scrub sensitive lines from ~/.zsh_history, why extended timestamps make sed tricky, and how to reload the active shell session.
Developer Security Guides
How to prevent committing .env files to git
Global gitignore configurations, pre-commit hooks, and how to audit existing repositories for uncommitted credential files.
How to prevent accidentally pasting secrets into Slack or web apps
Why clipboard leaks happen, how macOS clipboard management works, and how to mask tokens before sharing code snippets.
How to find unprotected and un-gitignored .env files on Mac
Audit all project directories on your Mac to find .env, .env.local, and credentials files that are missing from .gitignore before they get committed.
How to automatically clear clipboard secrets and API keys on macOS
Prevent credentials and API keys from lingering on your Mac's clipboard where web pages and background apps can read them.
How to mask API keys and secrets for screenshots and bug reports
Best practices and tools to format sensitive API keys and tokens into safely redacted strings like sk-live-••••••••xyzA for public issue trackers and docs.
How to remove a secret from .bash_history on Mac
Safely scrub sensitive tokens and export statements from Bash history files on macOS without losing your shell session.
How to remove an API key from git history (accidentally committed .env file)
Rotate the key first, then amend an unpushed commit or use git filter-repo or BFG to drop the file or string from all history, force-push, and ask GitHub to purge cached views.
I leaked my API key, what do I do? (pushed AWS key to GitHub)
An ordered checklist: revoke at the provider (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack), check audit logs for use, clean up git, shell history, chat and CI logs, then prevent the next one.
How to scan for secrets before you push (gitleaks pre-commit hook)
Install gitleaks with Homebrew, run it as a pre-commit hook with the current v8 commands (gitleaks git --pre-commit --staged), see what it catches and misses, and compare TruffleHog and git-secrets.
How to share a .env file with a teammate safely
Why Slack and email are the wrong channel, and the trade-offs between a password manager vault, a self-expiring link, age or gpg encryption, sops, and a secrets manager.
GitHub push protection blocked your push (GH013: Push cannot contain secrets)
Take the secret out of your unpushed commits with amend, git reset --soft or an interactive rebase, push again without forcing, and know when the bypass URL is the right call.
How to keep secrets out of Docker images (.env, ARG, ENV and docker history)
Check an image for leaked keys, keep .env out of COPY . . with .dockerignore, and replace ARG and ENV secrets with BuildKit secret mounts.
How to delete a secret from fish shell history on Mac
Find the leaked token in ~/.local/share/fish/fish_history without typing it again, remove it with history delete, check fish_variables for set -U values, and keep the next one out with a leading space or private mode.
How to keep secrets out of shell history on Mac (zsh, bash, fish)
Stock macOS zsh saves a command even when it starts with a space. Set HIST_IGNORE_SPACE and HISTORY_IGNORE, HISTCONTROL and HISTIGNORE in bash, use fish's built-in rule, and replace export TOKEN=... with read -s, op read, the Keychain or direnv.
AWS access key leaked: what to do in the first 10 minutes
Deactivate before you delete, confirm the account with sts get-access-key-info, search CloudTrail event history per Region, undo what the key created, rotate, and understand the AWSCompromisedKeyQuarantineV3 policy AWS attaches when GitHub reports the key.
GitHub revoked your personal access token? Why, and how to replace it on Mac
The documented reasons (expired, pushed to a public repo or gist, unused for a year, reported through the revocation API), how to check the security log, and how to replace the dead token in the Keychain, gh, ~/.git-credentials, shell profiles and .env files.