GitHub Sensitive Data Cleanup

What it does

Walks you through the full lifecycle of removing sensitive data from a Git repository's history and pushing the cleaned result.

• scan_repo.py — gitleaks plus custom regex layers, producing a JSON report
• Layer 4 AI semantic review — catches real names, project codenames, transcript snippets and other context regex can't see
• rewrite_history.py — creates and verifies a git bundle backup, then runs git filter-repo --replace-text
• verify_cleanup.py — rescans and greps every commit for the original strings
• safe_push.py — checks gh repo view for visibility and forks, prefers --force-with-lease, refuses --no-verify

Conservative by design: if any safety check fails, it halts and asks for human confirmation.

Who it's for

• Developers who accidentally pushed an API key or internal hostname to a public repo
• Anyone who needs git filter-repo/BFG but is nervous about the blast radius
• Teams auditing history before flipping a repo from private to public
• Security reviewers and open-source release managers

Examples

1. "Scan this repo for leaked secrets" → runs the scanner and summarizes /tmp/scan-report.json with severity triage
2. An internal domain appears across three years of commits → build a replacements file → backup bundle → rewrite → verify → safe push
3. About to force-push a public repo → the skill checks visibility and fork count, warns loudly, and drafts a notice for fork owners

Install the skill I found on Claude Skill Mart.
Copy the github-sensitive-data-cleanup folder from the GitHub repo daymade/claude-code-skills into my ~/.claude/skills/github-sensitive-data-cleanup/.
When it's done, tell me in one line what this skill can do.