Try 3

OMG, the password is still in my commits!

But I found an official documentation for the same situation. BFG Repo-Cleaner saved my life!

Fine, I will read the docs carefully next time.

bfg --replace-text secret_list
git push --force