I'm no git master and after searching around a bit I wasn't able to find a clear answer to this so I'm hoping someone can enlighten me:

Say I accidentally push some private info and overwrite the commit with a force push. The commit history doesn't show the mistake commit at all, but is it actually still accessible through reflog?

I'm pretty sure I've done this with some of my smaller projects so now I'm concerned that some of my passwords/keys are actually floating around somewhere. I read some info about reflog automatically pruning, is it likely that this is the case for my projects and I have nothing to worry about?