Secrets and .env
Rotate leaked keys, don't just delete them
Step-by-step response to a leaked API key: revoke, replace, redeploy, check usage. Why deleting the commit is not enough.
Why it matters
Once a key has been public, assume someone copied it. Git history, forks, CI logs and scrapers keep it alive after you delete the file, and leaked AI keys are drained quickly.
How to fix it
- Create a new key in the provider dashboard (OpenAI, Anthropic, Stripe, Supabase, AWS).
- Update the environment variables wherever the app runs and redeploy.
- Revoke or delete the old key.
- Check the provider's usage and billing pages for activity you don't recognise, and contact their support if there is fraud.
- Optionally rewrite history with git filter-repo. This is cleanup, not the fix.
How to verify
- Requests with the old key fail with an authentication error.
- Usage graphs return to normal.
Questions
- Is deleting the GitHub repo enough?
- No. Forks, clones and scrapers may already have it. Rotate the key.
- GitHub says it revoked my key. Am I done?
- Some providers auto-revoke keys reported by GitHub secret scanning. Still create a new key, check usage, and fix where it leaked from.
Related checks
Tick it off in the full checklist