A credential is public

The clock started when it was published, not when you found it. Automated collection of public secrets is continuous and fast, so treat the credential as used until the logs say otherwise.

Trigger. A secret scanner alert, a report from a researcher, or finding a key in a public repository.

The first 90 minutes1 of 5 expire

01 02 03 04 05

045 min90

01
Revoke, then rotate
by 15 minexpires
Revocation invalidates the key now; rotation issues a replacement. Doing only the second leaves the first one working. Start with the highest-privilege secret in the exposure.
02
Establish the exposure window from the history
by 30 min
The commit that introduced it and the moment it became public, which are not always the same if the repository was private first. Record both before any history rewriting.

Tell somebody

The owning team, without blame, because the reporting culture is what found this one
Whoever owns the platform the key belonged to, on what it could reach
Legal, if the credential could read personal data and use is confirmed

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Revoke, then rotate

Establish the exposure window from the history