Comment by revertmean

> your best bet is to make an entirely new clone

Or you can just rebase to edit the commits and remove the secret file. If you're really paranoid you can run `git gc` vto ensure the object file is cleaned up also. If you're super paranoid, then you can do:

git hash-object secretpassword.txt

And check that hash isn't an object in the `.git/objects` directory.