Check my git repository for secrets exposure. First, verify my .gitignore excludes .env files, credential JSON files, private keys (.pem, .key), and any provider config that contains secrets. Then search the git history itself, not just the working tree, for files and values that were committed in the past even if deleted later. For anything found in history: list the secret type and the commit where it appeared, and treat it as compromised. Create a rotation plan for each (regenerate at the provider, update the environment variable everywhere it's deployed). Explain the two cleanup options honestly: rotation makes the old values useless and is usually sufficient, while rewriting history with git filter-repo removes the file but breaks every existing clone and still doesn't help if anyone already saw the secret. Do not rewrite git history yourself. Do not modify any deployment configs; just tell me which environment variables need updating after rotation. If the repo is already pushed to a public remote, flag that prominently since scraping of public repos is automated. Deliver: gitignore status, a table of historical exposures with rotation instructions per provider, and the cleanup options with my decision points.