Take the 2-minute tour ×

This question already has an answer here:

I have a code base which I want to push to github as open source. In this git-controlled source tree, I have certain configuration files which contain passwords. I made sure not to track this file and I also added it to the .gitignore file. However, I want to be absolutely positive that no sensitive information is going to be pushed, perhaps if something slipped in-between commits or something. I doubt I was careless enough to do this, but I want to be positive.

Is there a way to "grep" all of git? I know that sounds weird, but by "all" I guess I mean every version of very file that ever was. I guess if there is a command that dumps the diff file for every commit, that might work?


share|improve this question
add comment

marked as duplicate by Cupcake, random, uthark, sandrstar, Sebastian Sep 6 '13 at 5:54


4 Answers

up vote 150 down vote accepted

Git can search diffs with the -S option (it's called pickaxe in the docs)

git log -Spassword

This will find any commit that added or removed the string "password". There is a regex version as well.

share|improve this answer
New enough git has also -G option, which "looks for differences whose added or removed line matches the given regexp", as opposed to -S, which "looks for differences that introduce or remove an instance of string" (or regexp with --pickaxe-regex) –  Jakub Narębski Dec 18 '10 at 0:23
I think you'd want this with --all as well (whether using -S or -G) –  Matt Enright May 6 '11 at 17:49
git log -Gpassword --all worked like a charm. –  pisaruk Jul 27 '12 at 17:54
I don't see how this isn't the chosen answer, since it's much faster than the grep loop and shows you the revision that added/removed the string instead of every single revision that contains it. It's also the directly supported git function. –  Devin Lane Dec 5 '12 at 17:33
If something does wind up committed, is there an easy way to remove it? Let's assume in this scenario there's a config file that I want to keep, but one line contains a password, which I want to remove from all of my git history. Any simple way to do that without rewriting every commit? –  Matt D Jan 28 '13 at 1:12
show 4 more comments
git rev-list --all | (
    while read revision; do
        git grep -F 'password' $revision
share|improve this answer
+1: I would have done "for revision in `git rev-list --all`; do git grep… done", but your approach is more reactive, as it greps while the revisions are being found. –  EOL Dec 17 '10 at 9:01
Is it possible to use this on a remote repository (like github)? –  studgeek Mar 16 '11 at 0:32
@reesd: Only if you clone it, of course. –  cdhowie Mar 22 '11 at 6:01
In order to avoid seeing matches from vendor/cache/ and public/assets/, change the grep line in this answer to: git grep -F 'password' $revision | grep -v ':vendor/cache/' | grep -v ':public/assets/' –  user664833 Jan 20 '12 at 18:47
add comment

What about git grep? You could move through every commit and check it. You could probably even script it.

Also, isn't the repository (.git) just text, short of the binary blobs? Can't you just grep that normally and do it all at once?

share|improve this answer
First, even in loose format (each object as individual file) data is compressed. Second, usually most of repository is in packed format (deltified and compressed). –  Jakub Narębski Dec 18 '10 at 0:18
You probably could, but since a git repo's history can be non-linear it wouldn't be that hard to miss one somewhere along the way. –  MatrixFrog Dec 19 '10 at 20:40
add comment

Try the following commands to search the string inside all previous tracked files:

git log --patch  | less +/searching_string


git rev-list --all | GIT_PAGER=cat xargs git grep 'search_string'

which needs to be run from the parent directory where you'd like to do the searching.

share|improve this answer
add comment
