1169

I have a code base which I want to push to GitHub as open source. In this Git-controlled source tree, I have certain configuration files which contain passwords. I made sure not to track this file and I also added it to the .gitignore file. However, I want to be absolutely positive that no sensitive information is going to be pushed, perhaps if something slipped in-between commits or something. I doubt I was careless enough to do this, but I want to be positive.

Is there a way to "grep" all of Git? I know that sounds weird, but by "all" I mean every version of every file that ever existed. I guess if there is a command that dumps the diff file for every commit, that might work?

3
  • 1
    it's limited in that it'll only search a single branch (master?), but it's pretty close to what you want github.com/divinity76/SearchGithubHistory.js/blob/master/… /
    – hanshenrik
    Commented Jan 23, 2015 at 13:12
  • 1
    Notwithstanding the 'Correct Answers', your requirement is to check that certain information is not committed publicly - the 'git' answer is only relevant since you are committing the whole history. Of course if you only commit the current revision, without history (use eg. "git archive"), then a simple 'grep' will suffice.
    – MikeW
    Commented Jul 20, 2016 at 12:28
  • 7
    not a duplicate. the other question is about just the logs, this one is about all of a git history. those are different.
    – worc
    Commented Dec 18, 2018 at 21:46

3 Answers 3

1820

Git can search diffs with the -S option (it's called pickaxe in the docs)

git log -S password

This will find any commit that added or removed the string password. Here a few options:

  • -p: will show the diffs. If you provide a file (-p file), it will generate a patch for you.
  • -G: looks for differences whose added or removed line matches the given regexp, as opposed to -S, which "looks for differences that introduce or remove an instance of string".
  • --all: searches over all branches and tags; alternatively, use --branches[=<pattern>] or --tags[=<pattern>]
13
  • 3
    If something does wind up committed, is there an easy way to remove it? Let's assume in this scenario there's a config file that I want to keep, but one line contains a password, which I want to remove from all of my git history. Any simple way to do that without rewriting every commit?
    – Matt D
    Commented Jan 28, 2013 at 1:12
  • 33
    In this particular case I'd also throw in a -i to make the search case insensitive.
    – dain
    Commented Oct 15, 2015 at 10:58
  • 16
    Just an FYI, the above command didn't really work for me. I did the following: git log -p -S <YOUR_SEARCH_TERM> I stole this info from this informative article about git pickaxe. Commented Feb 18, 2016 at 20:56
  • 33
    I don't know if this is new, but the linked docs says that -S looks for "differences that change the number of occurrences of the specified string" (emphasis added.) So if a commit adds the term you're seeking but also removes it from elsewhere, -S will not find it. -G, OTOH, doesn't do this.
    – shawkinaw
    Commented Mar 17, 2017 at 16:42
  • 10
    Thanks! Because this is such a useful reference, I'd add that -- path/filename will restrict the search to a file.
    – ptim
    Commented Mar 24, 2017 at 4:42
138
git rev-list --all | (
    while read revision; do
        git grep -F 'password' $revision
    done
)
7
  • 14
    +1: I would have done "for revision in `git rev-list --all`; do git grep… done", but your approach is more reactive, as it greps while the revisions are being found. Commented Dec 17, 2010 at 9:01
  • 3
    Is it possible to use this on a remote repository (like github)?
    – studgeek
    Commented Mar 16, 2011 at 0:32
  • 2
    @reesd: Only if you clone it, of course.
    – cdhowie
    Commented Mar 22, 2011 at 6:01
  • In order to avoid seeing matches from vendor/cache/ and public/assets/, change the grep line in this answer to: git grep -F 'password' $revision | grep -v ':vendor/cache/' | grep -v ':public/assets/'
    – user664833
    Commented Jan 20, 2012 at 18:47
  • You can get file names only (without commit hash) Also sorted and without duplicates. Check my answer for this. Thanks to this answer's OP from whom I took inspiration. Here is my answer
    – om-ha
    Commented Oct 25, 2021 at 22:09
73

Try the following commands to search the string inside all previous tracked files:

git log --patch  | less +/searching_string

or

git rev-list --all | GIT_PAGER=cat xargs git grep 'search_string'

which needs to be run from the parent directory where you'd like to do the searching.

1
  • 1
    The second command is significantly slower
    – Sigmatics
    Commented Jun 14, 2023 at 15:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.