agentic-security:security-rotate-leak

Rotating leaked API keys end-to-end involves detecting the exposed credential, identifying its provider, executing automated rotation, scrubbing git history, and migrating the replacement to a dedicated secret manager to minimize blast radius.

Scrubbing leaked credentials from git history is handled during the end-to-end rotation workflow. After masking the leaked values and rotating the secret, the process scrubs the exposed credential from your git history to ensure it is no longer accessible in previous commits.

You can automatically rotate exposed secrets by triggering the rotation workflow. The process executes end-to-end rotation via automated steps, handling provider identification, credential revocation, and replacement provisioning sequentially without requiring manual intervention.

Secret rotation supports migrating credentials to a dedicated secrets manager. After rotating the leaked secret and scrubbing git history, the workflow offers a guided path to provision the replacement credential directly into your dedicated secrets management system.

After a pushed-secret report alerts you to leaked credentials, you should immediately activate the rotation workflow. It masks the leaked values, identifies the provider, and executes end-to-end rotation to revoke the exposed credential and provision a secure replacement.

You need to mask leaked values before rotating exposed credentials to prevent further accidental exposure during the remediation process. Masking is an enforced step in the rotation workflow that secures the secret before provider identification and history scrubbing begins.