Revoke the exposed credential first, then pause the bots that used it, then work out what the account touched and rotate everything that shared it. The OWASP Secrets Management Cheat Sheet says exposed keys should be revoked immediately, and that revoked or rotated secrets must be removed from the exposed system.
First hour
- Confirm what leaked and where: a chat message, a shared folder, a workflow export, a log file. Note the time you found it.
- Revoke or reset the credential on the target system. Do not wait to finish the investigation, because every minute it stays valid is exposure.
- Pause the bots that use it. They will fail on the new credential anyway, and a paused schedule avoids lockouts and confusing alerts.
- Remove the exposed copy, such as the file or the message. Removing it does not make the credential safe, but it limits further spread.
- Tell the bot owner and your security contact.
Next few hours
| Question | Where to look |
|---|---|
| Was the credential used by anyone but the bot? | Sign in history for the bot account |
| What did the account do in the exposure window? | Application audit logs and bot run logs |
| What else shared the credential? | Other bots, scripts, test copies |
| What data could the account reach? | Its permissions, with an eye on read access |
| Who could have seen the leak? | Access list of the place it appeared |
This is where bot logs pay off. If actions are tied to bot, version and owner, you can separate bot activity from anything else. If every bot shared one account, you will treat all of them as affected.
Restore service
- Issue a new credential, stored in the managed secret store, not typed into workflows.
- Reduce the account's permissions to the minimum while you are at it.
- Test one low risk bot, then resume the others in small groups.
- Rotate any other secret that appeared alongside the leaked one.
Decide whether it is a reportable incident
If personal data may have been accessed, your obligations may include notification to regulators or customers. That is a question for your legal advisers and your incident process, so involve them early rather than late.
Write it up
Within a few days, write a short blameless record: how it leaked, how it was found, what the account touched, what you changed. Include the control that would have prevented it, such as a managed store or a block on pasting secrets into chat.
Prevent the repeat
- Keep credentials out of workflow files and shared drives.
- Give each bot its own account so the exposure stays small.
- Use expiry and regular rotation so a leaked value ages out.
- Make leaks easy to report, with no blame.
Our related post covers what to do when a live secret appears in logs.
Where Safeguard fits
Safeguard does not offer secret scanning. Its asset discovery and compliance evidence features can help you keep the inventory and incident records tidy.
Quick check
Should I delete the leaked message before revoking?
Revoke first. Deleting the copy does not undo the exposure, since someone may already have it.
Do I need to rotate other bots' credentials?
Rotate any that shared the account or appeared in the same place as the leak.
Sources
Last reviewed: 19 October 2026.
