Source code history is the retained record of changes made to a repository, including commits, branches, tags, and older file versions. Even if a secret is removed from the current codebase, it may still exist in earlier commits, pull requests, or mirrored clones. This matters because version history often remains searchable and accessible to developers, CI systems, and sometimes the public.
In cyber security, source code history can turn a brief mistake into a long-lived exposure. Attackers scan repositories for deleted passwords, API keys, and tokens because old revisions may still contain usable credentials. Defenders use history scanning, access controls, secret rotation, and repository rewrite tools when necessary, but the most important step is to treat anything committed once as potentially recoverable forever.