Unit 02.01: The key that reached your git history

A key that has ever been committed is public. The only action that helps is rotation.

Rotate first, tidy afterwards

Five steps in the order that matters.

The code lists them.

STEPS = [
    "1. rotate the key at the provider IMMEDIATELY -- it is compromised",
    "2. only then worry about the history",
    "3. removing it from git history does not un-leak it",
    "4. check the provider's usage log for calls you did not make",
    "5. add a pre-commit secret scan so the next one is caught",
]
for step in STEPS:
    print(step)

print("""
Order matters. Rewriting history first leaves a live key exposed for however
long the rewrite takes, and any clone, fork or CI cache still has it.

Assume a key that has ever been committed is public. Rotation is the only
action that actually helps; everything else is tidying.
""")

Rewriting git history first leaves a live key exposed for however long the rewrite takes, and every clone, fork, CI cache and local checkout still has it. Rotation invalidates it everywhere at once.

Checking the provider's usage log is the step people skip. If the key was exposed for a day, the log tells you whether anyone used it.

The mistake this prevents

The mistake is treating history rewriting as the fix. It removes the key from the canonical repository and from nowhere else, and the reassurance it provides is the dangerous part.

Takeaway

Rotate immediately; history rewriting is tidying. Check the provider's usage log, and add a pre-commit secret scan so the next one is caught before it lands.

Mark complete