Classify and contain
Identify the credential type, privileges, environments, owner, and every consumer. If it grants high-impact access, activate the incident process and restrict exposure immediately: disable the identity, block the token, narrow network access, or pause the affected integration when the operational cost is acceptable.
Preserve evidence about where and when exposure occurred, but never copy the secret into the incident ticket. A fingerprint or last few non-sensitive characters can help correlate records.
Create the replacement
Generate a new credential through the authoritative system. Do not derive it from the old value. Grant no more privilege than needed and attach an owner and expiry. Where the platform supports overlapping credentials, keep the original temporarily active only long enough to perform a controlled migration.
Update consumers methodically
Inventory deployments, CI variables, secret stores, scheduled jobs, local development, third-party integrations, and disaster-recovery environments. Update one group at a time, monitor authentication errors and business signals, and verify that each consumer is actually using the replacement.
“The deployment succeeded” is not proof of rotation. Confirm successful authentication with the new credential and check that no traffic continues to use the old one.
Revoke and investigate
Revoke the exposed credential, terminate related sessions, and verify that rollback mechanisms cannot restore it. Search logs for use from unexpected identities, addresses, regions, or times. Check whether the credential could reveal further secrets or allow persistence.
Prevent recurrence
Remove the value from Git history or artifacts where feasible, but remember that rewriting history does not retract existing clones. Add secret scanning, shorten credential lifetimes, replace shared identities, and improve the delivery workflow that caused the leak. Record time-to-detection and time-to-revocation so the team can improve the next response.
Sources and review basis
This guide is maintained as defensive-security education. The editorial team reviews its recommendations against current implementation experience and these authoritative references: