Q: A production secret was accidentally committed to a GitHub repository and developers have already cloned the commit. What are your exact step-by-step actions?

Do NOT waste time deleting the commit. Immediately log into the cloud/identity provider (AWS IAM, Database, Stripe, GitHub PAT) and revoke the compromised key or generate a replacement credential. Update production services with the new secret via Vault, AWS Secrets Manager, or Kubernetes Secrets.

# Example: Instantly deactivate compromised AWS IAM Access Key
aws iam update-access-key --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive
aws iam delete-access-key --access-key-id AKIAIOSFODNN7EXAMPLE

Search security audit logs (AWS CloudTrail, database query logs, API access logs) from the timestamp the commit was pushed to the moment the key was revoked. Search for any unauthorized API calls or IP addresses originating outside corporate CIDR blocks.

# CloudTrail lookup for actions taken by the compromised key
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAIOSFODNN7EXAMPLE \
  --start-time $(date -u -v-24H +%Y-%m-%dT%H:%M:%SZ)

Use `git-filter-repo` (recommended over legacy BFG or filter-branch) to purge the secret from all commits, tags, and tree objects. Force-push the cleansed history and notify all developers to re-clone the repository to prevent pushing old commit history back.

# Purge the sensitive file or string from entire git history
pip install git-filter-repo
git filter-repo --replace-text <(echo 'regex:AKIA[0-9A-Z]{16}==>REDACTED')
git push origin --force --all
git push origin --force --tags

Deploy automated pre-commit secret detection tools (`gitleaks`, `trufflehog`) across developer workstations and enforce GitHub Secret Scanning with Push Protection on all organization repositories so commits with raw keys are blocked at `git push` time.