Detecting and responding to leaked secrets

Assume a secret will leak. It might reach git, a chat, or a build log. The job is to catch it early and contain it fast. Detection has four layers, and the response has a fixed order: rotate first, then clean up.

Four layers of detection

1. Pre-commit hooks such as gitleaks, trufflehog or detect-secrets, on laptops and in CI.
2. History scanning of every branch and old commit, not only the latest one. A deleted secret still lives in old commits.
3. A CI gate that fails the build on high-confidence findings. Keep a documented baseline for known false positives.
4. Runtime signals. Cloud providers notify you about exposed access keys. GitHub secret scanning works with many issuers to revoke keys automatically.

Walking through a response

1. Rotate or revoke the secret now. Do not wait to learn how it leaked.
2. Invalidate sessions and tokens derived from it.
3. Check access logs for any use of the leaked credential.
4. Remove it from git history with BFG or filter-repo, after rotation.
5. Write a postmortem: how it entered version control, and which control failed.

Practice this before you need it. Some teams plant a fake key in a private branch, then time how long detection and rotation take. The drill finds gaps in scanning coverage before an attacker does.

Common mistakes

• Cleaning history first. The secret stays valid until it is revoked.
• Scanning only the latest commit. The secret stays in older commits.
• Passing secrets as build arguments. docker history can show them. Use BuildKit secret mounts instead.

Check yourself

1. Why rotate before rewriting git history? Answer: forks, clones and CI caches still hold the old value, so it stays usable until you revoke it.
2. Why scan history, not only the latest commit? Answer: a secret deleted from the latest commit still exists in every older commit.

Key takeaways

• Scan at commit time, in CI, across history and at runtime.
• On a leak: rotate, invalidate, check logs, clean history, then write a postmortem.
• Measure how long it takes to revoke a leaked secret, the same way you measure time to mitigate an outage.
• Next, read about postmortems for the write-up.

Further learning

About secret scanning (GitHub Docs)Prevent fraudulent use of your secrets by automatically detecting exposed credentials before they can be exploited.GitHub Docs

GitleaksFind secrets with Gitleaks 🔑. Contribute to gitleaks/gitleaks development by creating an account on GitHub.GitHub

TruffleHogFind, verify, and analyze leaked credentials. Contribute to trufflesecurity/trufflehog development by creating an account on GitHub.GitHub

Removing sensitive data from a repository (GitHub Docs)Sensitive data can be removed from the history of a repository if you can carefully coordinate with everyone who has cloned it and you are willing to manage the side effects.GitHub Docs