Summary
redact-history advances the notes ref tip with git notes add --force, but the pre-rewrite tip stays in .git/logs/refs/notes/prompts* and old blob objects remain in .git/objects/ until pruned. A user who runs redact-history to scrub a leaked secret still has it locally reachable.
Severity
P1 — incomplete scrub on the local clone. Confidence 90.
Status
PR #23 added a stderr remediation block (git reflog expire --expire=now --all + git gc --prune=now) so users have the recipe at the right moment. This issue tracks turning that recipe into a built-in step.
Suggested fix options
- New flag
prov redact-history --gc that runs reflog expire + gc after a successful rewrite, behind explicit opt-in.
- New subcommand
prov gc-secrets that does the cleanup alone (composable with the existing prov redact-history).
- At minimum: surface the recommendation in README +
--help.
Acceptance criteria
Reference
/tmp/compound-engineering/ce-code-review/20260502-075634-3af3d047/security.json (sec-002).
Summary
redact-historyadvances the notes ref tip withgit notes add --force, but the pre-rewrite tip stays in.git/logs/refs/notes/prompts*and old blob objects remain in.git/objects/until pruned. A user who runsredact-historyto scrub a leaked secret still has it locally reachable.Severity
P1 — incomplete scrub on the local clone. Confidence 90.
Status
PR #23 added a stderr remediation block (
git reflog expire --expire=now --all+git gc --prune=now) so users have the recipe at the right moment. This issue tracks turning that recipe into a built-in step.Suggested fix options
prov redact-history --gcthat runsreflog expire+gcafter a successful rewrite, behind explicit opt-in.prov gc-secretsthat does the cleanup alone (composable with the existingprov redact-history).--help.Acceptance criteria
redact-history+ the chosen cleanup path, the pre-rewrite blob SHA is no longer reachable (git cat-file -e <old-blob>returns non-zero).Reference
/tmp/compound-engineering/ce-code-review/20260502-075634-3af3d047/security.json(sec-002).