Chapter 2 · Practice 3 of 4
When a secret leaks, revoke and rotate it before cleaning history
Why it matters
GitHub's guidance is to revoke or rotate an exposed credential immediately. Bots scan public commits for keys continuously, so assume it has been seen. Rewriting git history is slow, often unnecessary once the key is dead, and does nothing about clones, forks and caches that already have it.
Work in this order:
- Revoke the old key with the provider.
- Issue a new one.
- Deploy the replacement.
- Only then decide whether to clean history.
Confirm the old key is dead by trying it once: the provider should reject it.
Do
- Revoke the key in the provider dashboard first
- Deploy the replacement before closing the incident
- Treat any key that was ever public as compromised