Why avoid committing secrets to Git, and secure local alternatives?

WHAT THIS TESTS: This question evaluates whether a candidate understands the immutable and distributed nature of version control, plus the principle of separating configuration from code. At the senior level, interviewers want to hear that you treat secrets as runtime configuration, not static assets, and that you understand incident response for accidental exposure.

A GOOD ANSWER COVERS: First, explain that Git is append-only and distributed. Once a secret is committed, it lives in the object database of every clone, fork, and backup. Even if you delete the file, amend the commit, or make the repository private, the secret remains in history and can be extracted by anyone with a copy. Second, describe the secure local alternative: environment variables or a dotenv file that is explicitly excluded by gitignore. The application reads configuration at startup, keeping credentials out of the repository entirely. Third, mention that for CI/CD, platform-native secret stores like GitHub Secrets, GitLab CI variables, or HashiCorp Vault should inject values at runtime. Fourth, note that if a secret is ever committed, rotation is mandatory because you must assume compromise; rewriting history is insufficient because you cannot guarantee all copies are erased.

COMMON WRONG ANSWERS: A major red flag is claiming that deleting the file in a subsequent commit or force-pushing a rewritten history fixes the issue. Another is asserting that private repositories are safe enough for secrets, which ignores insider risk, accidental forking, and future visibility changes. Obfuscation patterns like base64 encoding are also wrong because they are trivially reversible and still store the secret in history. Finally, suggesting hardcoded placeholders with manual replacement is a maintenance nightmare and error-prone.

LIKELY FOLLOW-UPS: The interviewer may ask how you would handle an accidentally committed secret. The correct process is immediate revocation and rotation of the credential, followed by history cleanup only to reduce accidental discovery, not as a fix. They might also ask about secret scanning tools like GitHub secret scanning or truffleHog, or how to manage non-production credentials for a team without sharing them in chat.

ONE CONCRETE EXAMPLE: Imagine a Node.js application using the AWS SDK. Instead of committing an aws-credentials.json file containing IAM keys, you create a gitignored .env file with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. At runtime, the application uses dotenv to load these variables. In production, the same variables are injected by the orchestrator or CI secret store, so the code never contains credentials and behaves identically across environments.

Source: docs.github.com