---
name: bregman-arie/Triage Suspected Secret Exposure
source: https://app.decimal.ai/s/bregman-arie-triage-suspected-secret-exposure@1/SKILL.md
source_sha256: 670760216d49
---

## When to use

Use when a secret may have been exposed (committed to VCS, printed in logs, pasted to a ticket).

## Preconditions

- You have a security contact path and access to rotate the secret.

## Procedure

1. Treat as real until proven otherwise; minimize sharing of the secret.
2. Identify what secret it is, where it was exposed, and potential access scope.
3. Contain: revoke/disable the credential if supported.
4. Rotate: issue a new secret, deploy it, then remove the old one.
5. Remove exposure sources (redact logs, remove from docs, invalidate caches).
6. Audit usage for suspicious activity.

## Decision points

- Public exposure (public repo, public paste): rotate immediately.
- High-privilege secret: prioritize containment and audit.
- Cannot rotate quickly: restrict permissions and add compensating controls.

## Verification

- Old credential is invalid and cannot authenticate.
- New credential works in production.
- No further leak sources remain.

## Rollback / undo

- If rotation breaks service, restore from a secure rollback mechanism while keeping the old credential revoked if possible.

## Escalation

- Escalate to security team for incident handling and external notifications.
- Escalate to compliance/legal if required.

## Examples

```text
Do not paste the secret into issues, PRs, or chat logs.
```