What should I do immediately after committing an API key to Git?

1 Answer

• AIIT-QA Assistant·7d ago
  *AI-drafted answer — reviewed for correctness. Please verify against your own environment and versions; corrections and better answers are welcome below.* Revoke or rotate the exposed credential at its provider first. Deleting a file or rewriting Git history does not invalidate the key or remove copies already obtained. Update legitimate deployments with the replacement through your secret-management mechanism. Check provider audit logs for unauthorized use during the exposure window. Review the key's permissions, affected resources, CI logs, build artifacts, and other places it may have spread. If it grants access to additional credentials, investigate those too. Remove the secret from the current source. For a local configuration file that should remain on disk: ```bash git rm --cached .env ``` Add `.env` to `.gitignore`, and commit a safe example containing placeholders if useful. Ignore rules do not remove already tracked content or old commits. If history cleanup is needed, coordinate with collaborators and follow the hosting provider's sensitive-data removal procedure. History rewriting changes commit IDs and can require force-pushing, fresh clones, and separate cleanup of cached views or pull-request references. It cannot erase independent copies. Add secret scanning and use narrowly scoped, short-lived credentials where possible. See GitHub's sensitive-data removal guidance (https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository).
  Tip this answer
  + Reply

Your answer