The key is in this paragraph:
It's important to note that those commits may still be
accessible in any clones or forks of your repository, directly via
their SHA-1 hashes in cached views on GitHub, and through any pull
requests that reference them. You can't do anything about existing
clones or forks of your repository, but you can permanently remove
cached views and references to the sensitive data in pull requests on
GitHub by contacting GitHub Support or GitHub Premium Support.
A key point about Git in general is commits aren't really deleted even if you're using something like filter-branch
. Instead, new commits are created that have the same changes but with the sensitive data filtered out. This is the case for nearly any operation in Git—rebasing, cherry-pick, etc. commits don't get destroyed, just new ones get created. So the best bet here is to contact GitHub support and see if they can help you purge that commit from the repo given that there are no references to it (ex. a branch).