API Key Pushed to GitHub? Rotate It First
Make a new key and revoke the old one at the provider straight away; deleting the file is not enough because Git keeps history and public repositories are scanned for keys. Then check the provider’s usage page for activity you did not cause, move keys into a .env file that Git ignores, and turn on secret scanning.
By PromptPack · Reviewed
What should you do, step by step?
- Revoke and replace the key. In the provider’s dashboard, create a new key and revoke the leaked one. Do this before cleaning up the repository.
- Update what used the old key. Put the new key in your app’s environment settings or secret store and redeploy. Anything still using the old key will stop working.
- Check for misuse. Review the provider’s usage, billing and audit logs for activity you did not cause, and contact the provider if you find any.
- Clean up the code. Remove the key from the code. Rewriting Git history can remove old copies, but treat the key as exposed either way.
- Prevent the repeat. Keep keys in a .env file listed in .gitignore, and turn on GitHub secret scanning and push protection where available.
General steps; each provider’s dashboard differs. Rotation stops future misuse of the old key but does not undo anything already done with it. See GitHub Docs: secret scanning.
Transcript
Juno: My API key is on GitHub. Publicly!
Pixel: Rotate it. Right now. Before anything else.
Juno: Can’t I just delete the file?
Pixel: Git remembers. And bots scan public repos fast.
Pixel: Make a new key, revoke the old one, then check the usage page for anything you didn’t do.
Juno: And next time?
Pixel: Keys live in a .env file that Git ignores. Turn on secret scanning so GitHub warns you first.
Juno: So deleting it was the least important step.
Pixel: Rotating was the important one. Follow for tomorrow’s disaster.
How was this video made?
PromptPack wrote the script and made the video with the two-character engine included in Juno & Pixel: AI text-to-speech voices, timed captions and a 3D scene rendered in code. The copy on this page is 720 × 1280. Juno and Pixel are fictional characters, and the situation is a story, not a real incident.
To make your own, read how to make animated character reels with code.