Respond to a secret leaked in a code repository
Walks you through containing a leaked API key, password, or token: revoke, rotate, check for misuse, and clean up history.
The prompt
Help me respond to a secret that was committed to a code repository.
Type of secret: [e.g. "cloud access key", "database password", "third-party API token", "private key"] (describe it; do not paste the actual value)
Where it leaked: [PRIVATE REPO / PUBLIC REPO / FORK / CI LOGS / PASTED IN CHAT]
How long it was exposed: [WHEN COMMITTED, WHEN NOTICED]
What the secret can access: [SYSTEMS, DATA, PERMISSIONS]
Who needs to know: [SECURITY TEAM, MANAGER - what our process says, if known]
Give me an ordered response plan:
1. Contain now (first 15 minutes): revoke or rotate the secret immediately. Explain why rotating comes before cleaning git history: assume it's already been copied, especially if it was ever public.
2. Notify: who to tell and a short message to the security team or manager with the facts above.
3. Check for misuse: which access logs or audit trails to review for the exposure window, and what suspicious activity looks like for this type of secret.
4. Replace safely: deploy the new secret through a secrets manager or environment variables, and update every place that used the old one.
5. Clean up: remove it from the code and, if needed, from history (e.g. with a history-rewriting tool), plus what to do about forks, clones, CI caches, and open pull requests. Note the coordination needed for rewriting shared history.
6. Prevent repeats: pre-commit secret scanning, CI scanning, .gitignore entries, and least-privilege scopes for the replacement secret.
Return a checklist with owners [ASSIGN] and a short incident note for the record. If personal or customer data may have been accessed, tell me to involve security and legal promptly, as there may be notification obligations.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- PRIVATE REPO / PUBLIC REPO / FORK / CI LOGS / PASTED IN CHAT
- WHEN COMMITTED, WHEN NOTICED
- SYSTEMS, DATA, PERMISSIONS
- SECURITY TEAM, MANAGER - what our process says, if known
- ASSIGN
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Implement a feature from a spec, with testsPlans and writes production-quality code for a feature, including tests and edge cases.
- Set up CI/CD and infrastructure as codeCI/CD pipelines and IaC templates with environments, checks, and rollback.
- Plan a major framework or dependency upgradeBuilds an incremental upgrade path for a framework, language, or library version, with breaking changes mapped to your codebase.
- Break my first coding project into small buildable stepsA milestone plan where every step leaves you with a working program and tells you what to learn next.