HIDDEN GITHUB COMMITS AND HOW TO REVEAL THEM

Summary from the TLDR InfoSec newsletter

The team at Neodyme has found a method to reveal hidden GitHub commits. The GitHub PushEvent API can be used to retrieve the hashes of commits that have been hidden using a force push. The commit can then be retrieved via the discovered hash. Neodyme has released a tool for discovering secrets via this method.