Secrets Hygiene

A leaked secret is a live incident until rotated. Treat any suspected exposure as confirmed until proven otherwise - the cost of an unnecessary rotation is always lower than the cost of a breach. The costly mistake this skill prevents is the instinctive wrong move: deleting the commit, force-pushing, and considering it handled while the key stays valid in every fork, clone, and scraper cache.

Operating procedure

The order is deliberate: rotation comes before investigation because every minute of analysis is a minute the credential works for an attacker.

Step 1: Gather inputs

• What leaked (or might have): credential type, issuing system (cloud console, API portal, identity provider), and the privilege it carries.
• Where and when: repo and commit, CI log, chat message, Docker image; how long it has been exposed. If unknown, assume the worst plausible window and label it a guess.
• Whether the repo is public, has forks, or has ever been public.
• Who can execute the rotation and whether a rotation runbook exists for this credential.

For prevention-mode engagements (no active leak), skip to Step 4.

Step 2: Respond to the suspected leak - in order, without delay