git filter-branch
It rewrote entire histories — and today its own manual says to call someone else.
For years it was the crypt's saw: rewrite every commit in the repository to tear out a leaked secret, move the whole codebase into a subfolder, swap an e-mail everywhere. A shell filter, applied commit by commit, first to last.
The honest caveat: its own documentation opens with a page-long warning — dreadful performance and pitfalls capable of corrupting the rewrite — and recommends git filter-repo instead, a tool external to git. The bone is displayed here the way a fossil is displayed: important, and retired.
$ git filter-branch --tree-filter 'rm -f segredo.env' HEAD
WARNING: git-filter-branch has a glut of gotchas [...]
Rewrite 3bf1f68 (312/312)
Ref 'refs/heads/main' was rewritten