On this page
Reference for the safegit scrub command group — subcommands, flags, arguments, and usage details for the scrub group in the safegit CLI.
#safegit scrub
surgically rewrite git history to remove or replace sensitive content using 4 subcommands (file, match, run, verify) that operate on all commits, trees, and blobs in the repository
#scrub file
replace or remove a specific file across all commits in the repository history, rewriting each affected commit tree to either substitute the file contents with a sanitized version or delete the file entirely from every historical snapshot
Effect: mutating · consequential (prompts before running; --approve-consequential skips)
#Flags
| Name | Short | Type | Default | Env | Description |
|---|---|---|---|---|---|
--from | str | first commit hash to include when rewriting history (default: root commit) | |||
--reason | str | mandatory audit trail message explaining why this scrub operation is needed | |||
--remap-shas-in | str | glob selecting files whose full 40-character commit hashes are remapped to the rewritten SHAs during the walk, keeping hash-referencing files like JSONL changelogs self-consistent at every commit (repeatable; same matching semantics as --scope; not applied inside submodule histories) |
#Arguments
| Name | Required | Description |
|---|---|---|
file | yes | repository-relative path to the file that should be scrubbed from history |
#scrub match
replace all occurrences of a regex pattern across every blob in the repository history, rewriting commit trees to substitute matched text with a replacement string so that sensitive values like secrets and credentials are permanently removed from all historical snapshots
Effect: mutating · consequential (prompts before running; --approve-consequential skips)
#Flags
| Name | Short | Type | Default | Env | Description |
|---|---|---|---|---|---|
--pattern | str | regular expression pattern to search for across all blobs in history | |||
--reason | str | mandatory audit trail message explaining why this scrub operation is needed | |||
--scope | str | glob pattern limiting which file paths are searched (e.g. '.env', 'config/*') | |||
--remap-shas-in | str | glob selecting files whose full 40-character commit hashes are remapped to the rewritten SHAs during the walk, keeping hash-referencing files like JSONL changelogs self-consistent at every commit (repeatable; same matching semantics as --scope; not applied inside submodule histories) | |||
--replace | str | literal string to substitute for each regex match found in history | |||
--mangle | bool | replace matches with random printable ASCII of same length | |||
--from | str | first commit hash to include when rewriting history (default: root commit) | |||
--entire-history | bool | rewrite all commits from the root of the repository to HEAD |
#scrub run
execute a multi-operation scrub recipe from a TOML file, applying all pattern replacements and file removals across history in a single coordinated pass with topological commit ordering, overlap detection between operations, and automatic verification that no matched content survives in the rewritten object store — use --diff to preview all changes as unified diffs before committing to the rewrite
Effect: mutating · consequential (prompts before running; --approve-consequential skips)
#Flags
| Name | Short | Type | Default | Env | Description |
|---|---|---|---|---|---|
--reason | str | mandatory audit trail message explaining why this scrub operation is needed | |||
--diff | bool | preview what would change without modifying any objects, showing unified diffs | |||
--limit | int | 50 | maximum number of blob diffs to show in --diff mode (default: 50) | ||
--remap-shas-in | str | glob selecting files whose full 40-character commit hashes are remapped to the rewritten SHAs during the walk, keeping hash-referencing files like JSONL changelogs self-consistent at every commit (repeatable; same matching semantics as --scope; not applied inside submodule histories) | |||
--from | str | first commit hash to include when rewriting history | |||
--entire-history | bool | rewrite all commits from the root of the repository to HEAD |
#Arguments
| Name | Required | Description |
|---|---|---|
recipe | yes | path to the TOML recipe file containing scrub operations |
#scrub verify
check all scrub policies defined in the repository configuration to confirm that previously scrubbed secrets and sensitive patterns remain completely absent from every object in the git object store, scanning blobs, commit messages, and tag annotations and reporting detailed per-policy pass or fail results with match locations for any violations found
Effect: read_only