> In case someone commits SSH keys or secrets accidentally, just overwriting them and leaving them in the database is not good enough.

git-filter-branch is likely not the solution.

Revoke the keys/secrets. Then maybe rewrite history too, but afterwards.