Faris Chtatou: “Fact. Always double check the git history.”

Faris Chtatou @farischt2d1aa5d9e

Deleting a leaked key from Git doesn’t disable it. LiteLLM’s October 23 incident report says a key exposed in May remained valid after the commit was rewritten. For agencies managing several client projects, the hard part is tracing where each credential is used: API services,…

keyrua.devLiteLLM’s Supply Chain Attack: What Agencies Should RotateLiteLLM’s October 2026 report traces a malicious release to a leaked key that stayed valid. A practical revocation and recovery guide for software agencies.

Suliman Benhalim @sulimanbenhalim2d14ebee9

and on github the old commit is still reachable by its sha after the force push, forks share the same objects. git doesn't forget, it just stops showing you lol

Faris Chtatou @farischt2d

Fact. Always double check the git history.

21:13 · Oct 26, 2026commit 60a7882

Commit