Sometimes a secret was removed long ago – but it lives on in an old commit. This optional scan searches your local Git history for those forgotten leaks.
What it does
With an extra flag, Env Clinic checks past commits for added secrets. It uses only your local Git – no outbound connection. Findings from history are always treated as critical.
Why it matters
A key that was ever in a commit counts as compromised – whether or not the file is clean today. Anyone who cloned the repo has the old version too. Such keys must be rotated.
How to use it
Enable the history scan with one flag. If Git isn't available, Env Clinic prints a safe warning instead of an error.
env-clinic scan . --include-git-history
- Uses local Git only
- History findings are always critical
- No crash without Git