Revocation is not retroactive, and serverless mode has no read log¶

Said in the uncomfortable truth and taking access away, repeated here because it is the single most misunderstood property of every system in this category. Anyone who ever cloned the repository has every file they could decrypt, permanently, including everything in git history. Removing their grant changes what they can read next, and nothing else.

In serverless mode there is additionally no record of reads, because no component of ours is present when a file is decrypted on someone's laptop. You get a complete record of changes and none of access.

Rotating the value is the only true revocation. Plan for it, and use the checklist the tool prints.