School · Module 6 · Lesson 4 of 4
Your first hour after a leak
Revoke, replace, redeploy, review. In that order.
Revoke the compromised credential at the provider. Replace it in env vars. Redeploy every surface that used it.
Review provider logs for abuse during the exposure window. Reset sessions if a session-signing secret leaked.
Write down what happened while it is fresh. That note is the start of the post-mortem, not a blame document.