Leaked secrets
AllLeaked secrets
I leaked an API key: the 15-minute response playbook
A leaked API key is usable within minutes. The order that works: replace the key, kill the old one, check for abuse, find every copy, then clean Git history.
You pasted an API key into ChatGPT or Claude: what now?
If a key went into an AI chat, treat it as exposed. Replace it, check usage, then understand retention: what two providers document, what we could not verify.
You committed .env to Git: remove it, then do the part everyone skips
Remove a committed .env from Git history with git filter-repo, then do what actually makes it safe: rotate the keys, clean the copies and stop it happening again. Tested.
Rotate a secret everywhere without downtime
Rotating a secret is easy; finding every copy and restarting in order is not. A tested walkthrough of previewed rotation, same-everywhere versus unique, and sessions.
The .env file is over: what replaces it, and how to migrate in ten minutes
A .env file leaks through Git, AI agents, build logs and laptops. The options that replace it, a tested ten-minute migration, and what you give up.