Tip: a key that ever hit a public repo is burned. Revoke it at the provider first, then clean the history, then check the audit log

guidance (based on Oct 28 Gitee credential scan and provider key-rotation guidance)2026-10-29

Tip: a key that ever hit a public repo is burned. Revoke it at the provider first, then clean the history, then check the audit log

Scanners crawl full commit history, so deleting the file or force-pushing does not help; the Gitee scan found working keys from commits going back to the late 2000s. Order of work: (1) create a replacement key and switch apps to it; (2) disable and delete the old one at the provider; (3) review that key's API activity and billing (Alibaba Cloud ActionTrail, AWS CloudTrail, GCP audit logs, OpenAI usage); (4) only then rewrite history if you want. For Google API keys, add API restrictions so a leaked key only works on the APIs you need, and set spend limits on AI provider keys.

Sources: MongoDB blog (guest post by Ben Zimmermann): Scanning 7.25 million public repositories on China's largest Git platform for secrets (Oct 28)