Code10x
Secretshard3-5 years

A token was committed, noticed the next day, and removed in a follow-up commit — the working tree is clean and `git log` shows a commit titled "Move the token to an environment variable." Is this incident closed? Walk through what you'd actually do.

No — removing a secret from the current working tree does not remove it from history. git log -p -S '<the token>' finds the exact commit that introduced it in seconds, and that history is sitting in every clone, every fork, every CI cache and every backup that was made before the fix. This is exactly what automated bots scanning public repositories do, often within minutes of a push. The only action that actually neutralises the exposure is rotating the token — making the old value invalid — because there's no way to "recall" every clone that already has it. Rewriting history afterward (git filter-repo, BFG) is worth doing to stop it spreading further, but it's cleanup, not remediation; it happens after the token is already rotated, not instead of it.

The lesson behind it →
Previous`@PostMapping("/users") public User create(@RequestBody User user) { return users.save(user); }` — the `User` entity has a `role` field with a public setter, because Hibernate's mapping needs one. What's the actual vulnerability here, and why does switching to a request DTO with only `name` and `email` fix more than just the `role` field?Next `npm audit` reports four high-severity advisories in a project's dependency tree, and the team has marked them accepted rather than fixed. A new reviewer flags this as unresolved. Walk through how you'd actually evaluate whether that's the right call, and separately, what a committed lockfile is protecting against that `npm audit` doesn't touch.
More on Secrets
A service issues JWT access tokens signed with `secret-A`, each valid for 15 minutes, with no server-side record of issued tokens. At 10:00 the team deploys `secret-B` and updates the verifier to accept both secrets. What is the earliest moment it's safe to make the verifier stop accepting `secret-A`, and why is that moment forced rather than a judgment call?