# Respond to a secret leaked in a code repository

Walks you through containing a leaked API key, password, or token: revoke, rotate, check for misuse, and clean up history.

- Topic: Software Development
- Framework: Few-Shot
- Level: Advanced
- Tags: Coding, Leadership, Plan, Code, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/respond-to-a-secret-leaked-in-a-code-repository

## Prompt

```text
Help me respond to a secret that was committed to a code repository.

**Type of secret:** [e.g. "cloud access key", "database password", "third-party API token", "private key"] (describe it; do not paste the actual value)
**Where it leaked:** [PRIVATE REPO / PUBLIC REPO / FORK / CI LOGS / PASTED IN CHAT]
**How long it was exposed:** [WHEN COMMITTED, WHEN NOTICED]
**What the secret can access:** [SYSTEMS, DATA, PERMISSIONS]
**Who needs to know:** [SECURITY TEAM, MANAGER - what our process says, if known]

Give me an ordered response plan:
1. **Contain now (first 15 minutes):** revoke or rotate the secret immediately. Explain why rotating comes before cleaning git history: assume it's already been copied, especially if it was ever public.
2. **Notify:** who to tell and a short message to the security team or manager with the facts above.
3. **Check for misuse:** which access logs or audit trails to review for the exposure window, and what suspicious activity looks like for this type of secret.
4. **Replace safely:** deploy the new secret through a secrets manager or environment variables, and update every place that used the old one.
5. **Clean up:** remove it from the code and, if needed, from history (e.g. with a history-rewriting tool), plus what to do about forks, clones, CI caches, and open pull requests. Note the coordination needed for rewriting shared history.
6. **Prevent repeats:** pre-commit secret scanning, CI scanning, .gitignore entries, and least-privilege scopes for the replacement secret.

Return a checklist with owners [ASSIGN] and a short incident note for the record. If personal or customer data may have been accessed, tell me to involve security and legal promptly, as there may be notification obligations.
```

## What to fill in

- PRIVATE REPO / PUBLIC REPO / FORK / CI LOGS / PASTED IN CHAT
- WHEN COMMITTED, WHEN NOTICED
- SYSTEMS, DATA, PERMISSIONS
- SECURITY TEAM, MANAGER - what our process says, if known
- ASSIGN

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.