A secret committed and then removed is still in the history, and the history is on every clone, every fork and every CI cache.
$ gitleaks detect --source . --log-opts="--all"
$ trufflehog git file://. --since-commit HEAD~500
# and the order of operations, which is not negotiable:
# 1. REVOKE the credential. now.
# 2. rotate whatever it protected
# 3. then, optionally, rewrite history
#
# rewriting history first is the mistake: it does not
# unpublish anything and it delays step 1.Assuming the secret is compromised the moment it is found is the only defensible position — it has been in every clone and possibly in a public fork, and there is no way to know. History rewriting is disruptive, breaks every open branch and does not recall what was already fetched, so it is a tidiness measure rather than a remediation. Adding the scan to CI is what stops the next one.