{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/rotate-an-exposed-credential-even-after-the-text-is-removed",
  "id": "MHC-D-RESEARCH-0665",
  "version": "0.1.0",
  "title": "Rotate an exposed credential even after the text is removed",
  "summary": "Deletion changes visibility; rotation changes validity.",
  "kind": "principle",
  "body": "Treat a genuinely exposed credential as potentially compromised. Follow the provider's incident procedure: rotate or replace it, revoke the old value as appropriate, inspect relevant use and remove it from history or logs where required. Do not assume rewriting the commit makes the credential safe again.",
  "limits": [
    "Credential-response sequence varies by provider; follow the relevant security procedure instead of improvising rotation order."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-6A6591C8A0A9FDD9"
  ],
  "evidence": [
    {
      "claim": "GitHub secret-security guidance recommends revoking or rotating real credentials that were exposed rather than merely removing the text from a commit.",
      "source_id": "RS-6A6591C8A0A9FDD9",
      "role": "supports",
      "note": "Exact rotation order and incident response depend on the credential provider and exposure scope.",
      "locator": "Secret leakage response"
    }
  ],
  "use_when": [
    "A real secret appeared in a commit, agent log or external tool call and has now been deleted."
  ],
  "avoid_when": [
    "Credential-response sequence varies by provider; follow the relevant security procedure instead of improvising rotation order."
  ],
  "example": "A token committed for two minutes is rotated even after the commit is amended because the old value may already have been copied.",
  "check": "The leaked value no longer authorizes access and the leakage path has a corrective action.",
  "sources": [
    {
      "id": "RS-6A6591C8A0A9FDD9",
      "title": "Secret leakage risks",
      "url": "https://docs.github.com/en/code-security/concepts/secret-security/secret-leakage-risks"
    }
  ],
  "relations": [],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}