● Git History Secrets

Deleting a secret isn't enough.

You committed an API key, noticed, and deleted it in the next commit. The key is gone from your files, so a normal scan sees nothing. But it is still sitting in your git history, and anyone who clones the repo can recover it. This scan walks your commit history and finds those secrets.

What it does

ShipSafe reads the file versions touched by each commit and runs its secret detection across them, then flags the dangerous case: a secret that is gone from your current files but still in history. Those are the ones to act on first.

Run it from your editor (MCP)

shipsafe_scan_history
  path: "."          # your local git repo
  maxCommits: 100    # how far back to look

The scan is read-only and fully local. It reads past file versions with git and never writes, pushes, or transmits your history anywhere.