Skip to main content

Credential incident

Contain and recover from a suspected token, key, or account exposure.

Treat a suspected exposure as real until evidence shows otherwise. Do not paste the credential into an issue, chat, commit, or command output.

Contain

  1. Revoke or rotate the affected credential in its owning service.
  2. Disable the affected workflow, integration, or deployment when it can still perform writes.
  3. Review recent npm publications, GitHub audit logs, releases, deployments, secrets, and account sessions.
  4. Preserve relevant logs without copying the secret.

Revoking a Git commit does not revoke a token. Removing a repository secret does not invalidate a token that still exists at the provider.

Recover

Prefer OIDC or an installation token with narrow scope over a replacement long-lived token. Restore service through the protected environment. Verify the exact package versions, tags, releases, and deployments that occurred during the exposure window.

Communicate

Open a private security record. State the exposure window, affected systems, confirmed actions, user impact, and remediation. Publish a public advisory when users must update or take another action.

Prevent recurrence

Remove the path that required the credential when possible. Add a focused check that rejects the unsafe configuration. Do not add another secret as a permanent workaround.