World 8: Shields: Security · Boss challenge

Leak drill

You will learn: to fix a leaked key fast, in the right order.

The problem

Drill time! A fake key slipped into your last commit. Good news: you have not pushed yet. Fix it fast.

Watch

~/diary $ git show --statcommit 38641c80c248817e619f5df8867478709768713b (HEAD -> main)Author: You <you@example.com>Date:   Fri Oct 30 09:04:00 2026 +0800    Add weather widget .env   | 1 + app.js | 3 +++ 2 files changed, 4 insertions(+)

There it is: .env in the newest commit. Three rooms, three fixes. Stuck? After 2 tries, a hint appears.

Try it

Clean up the leak, room by room.

Step 1 of 3: Stop tracking the key

Take .env out of the box, but keep the file on your computer.

Working folder

Empty

Staging area

Empty

Repository

4 save points
Add weather widget
Ignore log files
Add day 1 page

Hint

Run git status in each room first.

Check

Plot twist: that commit was already pushed to a public repo. What do you do first?

Check

Now put the full rescue in order. First step at the top.

First step at the top. Put these in order. Use the arrows, or drag.

Close the secret scanning alert
Rewrite history with git filter-repo
Rotate the key
Force-push and tell your team
Untrack .env and add it to .gitignore

You did it!

You can now handle a leaked key, pushed or not.