> Things like GitHub's Secret Scanning will still be there to check... When a DVCS is successful, there are many server software. For git, there is the officia

> Things like GitHub's Secret Scanning will still be there to check... When a DVCS is successful, there are many server software. For git, there is the official git daemon and its wrappers (gitolite...), but also many forges, some of them having many local instances (Giltab, Gitea...). Grace should not depend on an optional (and error prone) feature of the server. > Git not being able to delete versions I don't understand. There is no concept of "version" in Git. You can delete commits, references and objects. For instance, you can delete/update a commit in your local branch. The old commit is still reachable, but you can run the garbage collector to delete it. You can also force a push that delete commits on a distant repository. As far as I know, the problem with deleting published secrets on public forges is that as soon as anything is published bots will copy it. And some of these bots are ill intentioned.