Rewrite commit history

I need the project history rewritten so the bad API key never appears in any commit. Rewrite the last 12 commits to remove the key, keep the authored dates and authors intact, and preserve merge commits where possible; stop and show the rewritten commits for verification before finalizing.

Before I rewrite history for the security scrub, make it easy for reviewers to approve: show a short summary of which commits will change, which files and lines contain the secret now, the risk if we delay, and a clear checklist of backups I should make so reviewers can sign off without fearing lost work.

A recent scan flagged a secret in our main branch from three commits ago. I am worried rewriting history will break teammates' work and CI, and I cannot tell who has local clones. What's the most likely safe approach to erase the secret while minimizing disruption, and what immediate communications and safeguards should I put in place?

Across several repos, we repeatedly commit credentials, then rewrite history to remove them. This costs hours, creates merge conflicts, and erodes trust. Which habit or process change would stop most of these incidents — a single guardrail that developers will actually follow — and how should I roll it out to engineering to avoid pushback?