ChecklistCONSTRUCTEDUntested

First 15 minutes: a secret was pushed to a public repository

An API key, password or token is public. Scrapers find these within minutes, so revoke first and investigate second. Deleting the commit does not un-publish it.

high severityCredential AccessT1552.001T1078.004

The clock starts when

Secret scanning, a researcher, a colleague or a vendor reports an API key, password, token or private key in a public repository, gist, paste site or published package.

0 of 9 done

minutes 0 to 5

Make the secret worthless

Revoke or rotate the secret at the service that issued it.Automated scrapers watch public commits. Assume it was copied the moment it was pushed.
If you cannot revoke it straight away, narrow it: disable it, or restrict it by address or scope.
Write down what it was, what it could reach, when it was committed and when it was revoked.That window is the scope of everything that follows.

minutes 5 to 10

Find out whether it was used

Search the issuing service's logs for use of the secret from the commit time to revocation.expires
Look for resources created, data read, and new credentials or users made with it.A key used for ten minutes can create another key that lasts for ever.
Check for the same secret in forks, package registries and CI logs.

minutes 10 to 15

Clean up without pretending it never happened

Remove it from the repository history if that is your policy, and still treat it as disclosed.Forks, clones and caches keep what history rewriting removes.
Scan the rest of the repository and its forks for other secrets.
Turn on push protection or a pre-commit secret scanner for the repository.

Do not

Do not delete the repository or force-push and call it fixed. The secret works until it is revoked.
Do not wait to find out whether it was used before revoking it.
Do not paste the secret into a ticket or chat to discuss it. Refer to it by where it lives.

Escalate now if

It is a cloud administrator key, a root credential or a signing key.
The issuer's logs show use by somebody you cannot identify.
It could reach customer or personal data.

Minute sixteen. The checklist ends here and the response does not.

Open the exposed secret playbook

Why this order

It is tempting to investigate first, to find out whether the key was used before deciding how worried to be. That gets the order backwards. Revoking a key that was never abused costs a deploy. Waiting to revoke a key that is being abused costs whatever it can reach.

What this does not cover

Anything the key was used to create. If the logs show activity you cannot explain, the incident is now the account the key belonged to, and the playbook linked above takes it from there.

sources

Tags: first-15 · secrets · github · credentials · cloud · supply-chain · T1552.001