So in this case even if you force push to the highly starred repo people could see that it had old commits (and restore to those on their local too).
Nice writeup on it: https://medium.com/git-tips/githubs-reflog-a9ff21ff765f
This has definitely saved my bacon when I've force pushed to a GH repo before and had to restore something.
Say I accidentally push some private info and overwrite the commit with a force push. The commit history doesn't show the mistake commit at all, but is it actually still accessible through reflog?
I'm pretty sure I've done this with some of my smaller projects so now I'm concerned that some of my passwords/keys are actually floating around somewhere. I read some info about reflog automatically pruning, is it likely that this is the case for my projects and I have nothing to worry about?
As GitHub themselves say:
> Warning: Once you have pushed a commit to GitHub, you should consider any data it contains to be compromised. If you committed a password, change it! If you committed a key, generate a new one [0]
[0]: https://help.github.com/articles/removing-sensitive-data-fro...
That said, if the request for the Events (as shown in the previous link) doesn't show the problematic commit - or a commit that extends it -, I don't think anyone could fetch it without previously knowing the ID, and if they do, it's probably because they already have a local copy.