bregman-arie When to use
Use when a secret may have been exposed (committed to VCS, printed in logs, pasted to a ticket).
Preconditions
- You have a security contact path and access to rotate the secret.
Procedure
- Treat as real until proven otherwise; minimize sharing of the secret.
- Identify what secret it is, where it was exposed, and potential access scope.
- Contain: revoke/disable the credential if supported.
- Rotate: issue a new secret, deploy it, then remove the old one.
- Remove exposure sources (redact logs, remove from docs, invalidate caches).
- Audit usage for suspicious activity.
Decision points
- Public exposure (public repo, public paste): rotate immediately.
- High-privilege secret: prioritize containment and audit.
- Cannot rotate quickly: restrict permissions and add compensating controls.
Verification
- Old credential is invalid and cannot authenticate.
- New credential works in production.
- No further leak sources remain.
Rollback / undo
- If rotation breaks service, restore from a secure rollback mechanism while keeping the old credential revoked if possible.
Escalation
- Escalate to security team for incident handling and external notifications.
- Escalate to compliance/legal if required.
Examples
Do not paste the secret into issues, PRs, or chat logs.