Principle
Rotate an exposed credential even after the text is removed
Deletion changes visibility; rotation changes validity.
When it fits
- A real secret appeared in a commit, agent log or external tool call and has now been deleted.
When to avoid it
- Credential-response sequence varies by provider; follow the relevant security procedure instead of improvising rotation order.
Why it matters
Treat a genuinely exposed credential as potentially compromised. Follow the provider's incident procedure: rotate or replace it, revoke the old value as appropriate, inspect relevant use and remove it from history or logs where required. Do not assume rewriting the commit makes the credential safe again.
An example
A token committed for two minutes is rotated even after the commit is amended because the old value may already have been copied.
Check your result
The leaked value no longer authorizes access and the leakage path has a corrective action.
Keep this limit in mind
- Credential-response sequence varies by provider; follow the relevant security procedure instead of improvising rotation order.
Evidence and sources
Supports
GitHub secret-security guidance recommends revoking or rotating real credentials that were exposed rather than merely removing the text from a commit.
Exact rotation order and incident response depend on the credential provider and exposure scope.
Secret leakage risks · Secret leakage response