Careful, amending doesn’t actually remove the bad commit, but it rather creates a new one and changes the appropriate branch pointer towards it. The old commit

Careful, amending doesn’t actually remove the bad commit, but it rather creates a new one and changes the appropriate branch pointer towards it. The old commit is still there, browsable if you know what you’re doing. This is fine if you’re doing it locally only, but incredibly misleading if you’ve already pushed the bad commit to a remote repository. It’s possible to remove sensitive data from Git, but it requires commands rarely used in a day to day workflow. It’s better to assume that any committed credential is burned and re-issue them.