secret-rotation

When to use

• A secret (API key, token, password, private key, connection string) was committed, pushed, pasted in a PR, or exposed in logs.
• A scanner (secscan, GitHub secret scanning, gitleaks) flagged a live credential.
• A laptop, CI runner, or third-party service was compromised.

Process — rotate FIRST, scrub second

1. Stay calm and assume compromise. If a secret left your machine, treat it as already in someone's hands. The clock matters more than tidiness.
2. Rotate / revoke at the provider FIRST. Generate a new credential and invalidate the old one in the provider's console (AWS IAM, Stripe, GitHub, etc.). Deleting the line in code does NOTHING — the old value still works until revoked.
3. Deploy the new secret to env vars / your secrets manager and verify the app works on the rotated value.
4. Then remove the secret from the working tree and from git history.
5. Audit for misuse — check provider access logs / billing for unexpected activity during the exposure window.
6. Prevent recurrence — add a pre-commit secret scan and move config to a manager (see "How to fix").

Checklist

• New credential issued and confirmed working in the target environment.
• Old credential REVOKED at the provider (not just removed from code).
• Secret pulled from source and .gitignore/secrets manager updated.
• Secret purged from git history (commands below) and force-pushed.
• Collaborators told to re-clone or hard-reset (rewriting history breaks their local copies).
• Provider access/audit logs reviewed for abuse during exposure.
• Pre-commit secret scanning enabled to stop a repeat.

How to fix

• Purge from history (after rotating). Preferred: git filter-repo --invert-paths --path path/to/file or for a value: git filter-repo --replace-text expressions.txt. Alternative: BFG — bfg --replace-text passwords.txt. Then git push --force to all remotes. Note: GitHub caches; the old commit may still be reachable via its SHA, so rotation is what actually protects you.
• Store secrets properly — environment variables, AWS/GCP/Vault secrets manager, GitHub Actions encrypted secrets, or a .env that is git-ignored. Never in source, never in client-side bundles.
• Prevent — install gitleaks/secscan as a pre-commit hook and enable provider-side secret scanning + push protection.

Report back

State plainly: what leaked, where, the exposure window, and — most important — that the credential was REVOKED and ROTATED (not just deleted). Then list history-purge status, log-review findings, and the prevention control you added. If rotation is still pending, say so loudly: until the old value is revoked, the incident is open.