World 8: Shields: Security

Leaked a key? Rotate first

You will learn: what to do, in what order, when a key leaks.

The problem

~/diary $ git show --statcommit 38641c80c248817e619f5df8867478709768713b (HEAD -> main)Author: You <you@example.com>Date:   Fri Oct 30 09:04:00 2026 +0800    Add weather widget .env   | 1 + app.js | 3 +++ 2 files changed, 4 insertions(+)

Oh no. This commit went to a public repo an hour ago. It holds .env and its key. Assume someone already copied it.

Watch

Step one: the key. Go to the service that gave it to you. Cancel the old key and make a new one. Now the leaked copy is useless.

Try it

Some people just stop tracking .env in a new commit. Is the key gone? Slide back in time.

.env at each commit

c005c2c Stop tracking .env · Commit 5 of 5

.env—

The newest commit has no .env. One step back, the key is still there. Anyone can look.

Try it

Here is the full rescue plan. Put it in order, first step at the top.

First step at the top. Put these in order. Use the arrows, or drag.

Rotate the key: cancel it, make a new one
Untrack .env and add it to .gitignore
Force-push and tell your team
Rewrite history with git filter-repo
Check the secret scanning alert, then close it

Try it

rewrites every commit. It is a separate tool you install. Build the command that wipes .env from all history.

Tap the pieces in the right order.

…

Predict

You rewrote history and force-pushed. But you never rotated the old key. Is it safe now?

Check

Good move, or needs work? Swipe each one.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Rotate the key right away

You did it!

You can now handle a leaked key in the right order.

Go deeper (optional)

Rotating is the must. Rewriting history is extra clean-up, and it changes every later commit id. Key inside a normal file, like app.js? Use --replace-text with a list of secrets. --sensitive-data-removal needs git filter-repo 2.47 or newer. Old pull requests may still show the key. GitHub Support can help clear those.