BlackBox is also great for this purpose:

https://github.com/StackExchange/blackbox

Albeit I havent made any effort to try to fix it - its a bit hard to compile on Windows.

Thanks. Checking it out

Old commits are still showing the credentials. Recommend following this guide to erase your .env from all commits.

https://help.github.com/articles/removing-sensitive-data-fro...

It's too late now in any case. Removing them is cute, but in terms of security credentials can only be rotated now. Removing them doesn't help when someone has already pulled that history previously.

You should still do it for future references