Signed Commits: When Your Team Should Bother

Wed, 21 Oct 2026 00:00:00 GMT

A commit's author line is a text field anyone can set. Signing replaces "trust the name" with "trust the key". Whether your team needs that depends on what the repo protects.

The cheap version: sign with your SSH key

No GPG setup anymore — git signs with the SSH key you already push with:

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

Add the same public key to your git host as a signing key and your commits show as verified.

When it earns the setup

Repos whose history feeds audits or compliance, where "who actually wrote this" needs an answer.
Open source or vendor code others build on, where a forged author line is a real supply-chain risk.
Teams with contractors coming and going, where key rotation is easier to reason about than usernames.

When to skip it

A private repo for a two-person team that reviews everything anyway gains little. Signing proves authorship of the commit, not quality of the code — review is still the control that matters.

If you adopt it

Turn on the host's "require signed commits" only after everyone signs comfortably. Flipping it early just teaches people to bypass the rule.

A Secret Got Committed. Now What?

Sun, 18 Oct 2026 00:00:00 GMT

It happens: .env, an API key, a database password ends up in a commit. The fix is the same every time, and the order matters.

1. Rotate the secret first

Deleting the file from git does nothing while the key still works. Assume anything committed is public, even in a private repo: clones, forks and CI caches all copy it. Revoke or rotate the credential at the provider before touching the repository.

2. Scrub the history

Once the old key is dead, remove it from history so the repo stops carrying it. git filter-repo is the tool that works:

pip install git-filter-repo
git filter-repo --path .env --invert-paths

This rewrites every commit, so force-push and have the team re-clone. A commit hash they still hold can resurrect the file.

3. Stop it happening again

.gitignore the file and commit a .env.example with the keys but no values.
Laravel reads real values from the environment, so nothing secret needs to be in the repo at all.
Turn on your host's push protection or run a pre-commit scan so a key gets caught before it lands.

The short version

A scrubbed repo with a live key is still a breach. A rotated key with an ugly history is just housekeeping. Rotate first.

Laravel Git Blog - Security