filter-repo quick

git filter-repo --force --path '*.env' --invert-paths (scrubs file from history) + git push --force-with-lease origin --all --tags (rewrites remote). Rotate exposed secrets after.