When a secret scanner raises an alert, first decide if the value is real and still valid. If it is, revoke it and issue a replacement before anything else. Cleaning code and git history comes after, because a copied credential keeps working until it is revoked.
Step 1: classify the finding
| Finding | Action |
|---|---|
| Live credential | Revoke and replace now |
| Expired or already rotated | Close with a note, remove from code |
| Example or test value | Mark as a known fake, adopt a shared fake format |
| Hash, ID or random string | Mark false positive, tune the rule |
| Unsure | Treat as live until proven otherwise |
Step 2: contain
Revoke the credential at the provider. Restarting an application does not revoke a stolen credential, as the OWASP secrets guidance points out. Issue a replacement, ideally through an automated process, and deploy it.
Step 3: look for use
Check provider logs for use of the old key from places you do not recognize, and record who had access, when it was used and when it was last rotated. Those are the records OWASP recommends keeping.
Step 4: remove
Remove the value from code, logs and config. Rewriting git history has side effects and is often unnecessary once the credential is revoked, which is also GitHub's stated guidance. Decide deliberately.
Step 5: prevent
- Add a pre-commit hook and a CI check.
- Move the secret to a secrets manager or injected environment value.
- Narrow the replacement credential's scope.
- Give each service its own credential, so a leak can be traced.
For the full order see leaked secret response order of steps.
Reduce false alerts
Agree one standard fake value per secret type across the organization, as OWASP suggests, and run more than one detection method. Document accepted exceptions with an owner and review date.
How Safeguard helps
Safeguard covers SBOM and dependency scanning, reachability analysis, and policies and gates that apply in pull requests. The free scan is a quick way to see your dependency findings.
Quick check
Should I rewrite history before revoking?
No. Revoke first. The value may already be cloned or cached elsewhere.
Is a test key alert worth ignoring?
Only after confirming it is fake. Use a recognizable shared fake format so the next alert is quick to clear.
Sources
- OWASP Secrets Management Cheat Sheet (fetched 19 October 2026).
- GitHub Docs, About secret scanning (fetched 19 October 2026).
Last reviewed: 19 October 2026.
