MSRXPlaybooks / Leaked key or secret
I leaked an API key or password
A key, token or password was committed to git, pasted in a chat or ticket, or shown in a screenshot.
Use this the moment you notice. Bots scan public GitHub for new keys within minutes, so speed matters more than anything else.
Right now
- Revoke or rotate the secret at the provider (AWS, Stripe, OpenAI, Google, GitHub, database). Deleting the commit does not help: assume it was copied.
- Create the new secret and put it in the place that holds secrets (environment variables, a secrets manager), never in code.
- Update the apps that used the old one so nothing breaks, then confirm the old one no longer works.
Check for misuse
- Open the provider's usage or audit log for the period since the leak: unknown API calls, new users, new resources, spend spikes, data downloads.
- For cloud keys, look for new compute instances, new access keys, changed permissions, and anything created in regions you do not use.
- For a leaked database password, check the database's connection log and look for bulk reads.
- Paste a suspicious file into the Leaked secret finder to see if more secrets are in it.
Clean the source
- Remove the secret from the code and, if the repository is shared, from git history with git filter-repo or BFG. Rotation is still required: this only stops further spread.
- Add a secret scanner to your workflow: gitleaks as a pre-commit hook, and GitHub secret scanning with push protection.
- Scope keys narrowly (one job, read-only where possible) so the next leak costs less.
General guidance, not legal or forensic advice. For a serious incident, involve a professional incident-response firm.