School · Module 1 · Lesson 3 of 4
Rotate a leaked key the same day
Revoke first, then replace, redeploy and check usage logs.
Revoke the leaked key at the provider so it stops working immediately. Creating a new key without revoking the old one leaves the attacker with access.
Put the new key only in the production (and matching preview) environment variables, redeploy, then watch the provider's usage log for calls from unexpected IPs or regions.
Treat git history as compromised until you rewrite it and force every clone to re-fetch.