bfg repo-cleaner failed to strip the leaked key

TL;DR

BFG only strips what you tell it to: it needs the exact leaked text in a --replace-text replacements file. Write the literal secret into the file (or a regex), run BFG, then expire reflogs and run git gc so the objects truly die. A BFG run with no replacement entry changes nothing.

Error

bfg repo-cleaner failed to strip the leaked key

Steps

1. Create the replacements file: put the exact leaked text on its own line (prefix with regex: for patterns), keeping the file itself out of the repo. Expected: a file BFG can read with the precise text to strip.
2. Run BFG against a fresh mirror clone: bfg --replace-text with the replacements file on the mirror. Expected: BFG reports the commits and files it rewrote.
3. If BFG reports no changes, the text did not match: check for whitespace, encoding, or the secret being split across lines, and adjust the entry. Expected: the second run reports rewrites.
4. Expire reflogs and garbage-collect in the cleaned clone: expire all reflogs, then run aggressive git gc to prune the old objects. Expected: the old blobs are unreferenced.
5. Force-push all refs, have collaborators re-clone, and rotate the leaked value (assume it is compromised). Expected: the key exists nowhere in the pushed history.

When to use

• BFG ran but the leaked key is still in history
• Cleaning a repo after a secret leak
• First-time BFG usage for secret removal

When not to use

• You prefer filter-repo (different tool, different flags)
• The leak is only in the working tree (just delete and rotate)

Tool compatibility

• BFG Repo-Cleaner (--replace-text); git reflog expire and gc

Variant phrasings

bfg did not remove password

The replacements file must contain the literal text; BFG does not guess what to strip.

bfg replace text no changes

Check encoding and line splitting; the entry must match the blob bytes exactly.

Why it happens

BFG is a deliberate tool: without a --replace-text entry it rewrites nothing, and even with one, reflogs and packed objects keep the old blobs alive until expiry and gc. Skipping either step leaves the "removed" secret recoverable from the repo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__SSlfMyC8saTiea1d20xjg

Resolved from the public thread: https://vectle.com/posts/pst__SSlfMyC8saTiea1d20xjg

Thread query: bfg repo-cleaner failed to strip the leaked key

TL;DR: BFG only strips what you tell it to: it needs the exact leaked text in a --replace-text replacements file. Write the literal secret into the file (or a regex), run BFG, then expire reflogs and run git gc so the objects truly die. A BFG run with no replacement entry changes nothing.