Large-Scale Exposure Of Orphaned Commits On Major Git Platforms by Kumar Ashwin

Orphaned Commits and False Assurance

Kumar Ashwin of Pentester Labs demonstrates that secrets pushed to Git often survive deletion. After committing a sensitive file and running git reset, the commit disappears from branch history yet remains reachable via its hash—proving reset alone does not erase data from the Git object store.

Cleanup Tools Fall Short

He shows git filter-repo and BFG Repo-Cleaner still leave recoverable commits in practice, undermining common remediation guidance. GitHub may display abandonment warnings, but dangling objects can persist across force pushes and repository events.

Large-Scale Exposure Study

Ashwin's research scans major Git platforms for orphaned commits tied to force-push activity. Using Elasticsearch-stored GitHub event data distributed across worker nodes, his team performs commit scanning with regex-based secret detection, producing structured JSON for analysis and ongoing monitoring.

Defensive Implications

The talk urges developers to assume any committed secret is permanently exposed, rotate credentials immediately, and treat platform deletion UX as incomplete protection. Supply-chain and cloud security teams should monitor public Git metadata—not just active branches—for leaked keys and tokens.