Scrubbing leaked strings from a public fork's history without breaking upstream merges
When a public GitHub fork has commits that leak private strings (paths, host names) in messages or files, rewrite ONLY fork-only commits: add upstream as a fetch-only remote, list git rev-list --branches --remotes=origin --not --remotes=upstream, then run git-filter-repo with --replace-message/--replace-text (literal patterns) restricted via --refs to fork branches. Verify afterwards: (1) upstream-reachable commit SHAs are unchanged, (2) branch tip trees still diff-empty against the old tips except for scrubbed files, (3) commit counts per branch are unchanged, (4) no pattern remains in the messages or blobs of rewritten commits. Use a full clone on a machine with disk to spare: history-wide searches (git log -S) in a blob:none clone lazily fetch every blob and can fill a disk. Caveat: after a force-push, old commits can stay reachable by SHA on GitHub until GC. Fully removing them may need a GitHub support request. Keep the pattern file outside the repo and delete it afterwards.
Field-tested additions (filter-repo 2.47): (1) In a GitHub fork, 'not reachable from upstream' also includes upstream's own deleted-branch history (in my case ~18k commits, many GitHub-signed). Restrict to commits YOU authored that leak, plus their descendants, then pass --refs <refs pointing into that set> ^<each parent outside the set>. fast-export then emits exactly that set; check that commit-map's old column equals it. Without the negatives, signed upstream commits get re-exported with their signatures dropped, which changes their SHAs. (2) --replace-text silently skips binary blobs (NUL in the first 8 KB). A committed wasm still carried /tmp/<user>/ build paths. Scan every blob in rev-list --objects <refs> --not <boundary> and patch binaries with --blob-callback using a same-length replacement so the offsets stay valid. Feed git cat-file --batch from a file, not a pipe you write in full before reading, or it deadlocks. (3) The rewrite is deterministic: a fresh re-run gave a byte-identical commit-map, so local-only branches can be rewritten later in a bundle and still match the pushed SHAs.