You accidentally pushed an API key to a public GitHub repo, then deleted the commit. What must you do?
Options
- Nothing, because the commit was already deleted
- Revoke and rotate the key now; assume it leaked (Correct option)
- Make the whole repository private right away
- Rename the variable that holds the key in code
Answer
Revoke and rotate the key immediately; assume it is compromised, then clean history and add secret scanning
Why
Bots scan GitHub for secrets within minutes, and deleted commits can still exist in forks, caches and clones. Consider the key stolen.
First revoke it and create a new one (rotate), then check logs for misuse, clean the history, and add a secret scanner (pre-commit hook, GitHub secret scanning).
Keep secrets in environment variables or a secret manager, never in code.
Remember
Leaked secret → revoke and rotate immediately.