Purging Real Hostnames from .env.example History
Gitleaks already watches for API tokens and private keys. It does not scream as loudly about a shared-hosting SFTP username sitting in .env.example since the first commit. The password was a placeholder — your_password_here — but the host and account name were real and public in every clone.
While hardening the writing workflow I fixed the example file, rewrote history with git-filter-repo, force-pushed main, and deleted stale remote branches that still carried the old blob. This post is the runbook so I do not treat placeholders as optional next time.
.env.example listed SFTP_HOST and SFTP_USER for the IONOS webspace. The password line was never a live secret, but host plus username is enough for targeted brute force and for mapping which panel owns the site.