Rotate the secret immediately, then check its access logs for use, then record what happened and fix the cause. Do not spend time debating whether the vendor kept the text. You cannot verify that from the outside, and rotation costs far less than guessing wrong.
First hour
- Revoke or rotate. Issue a new credential and disable the old one. For a cloud key, use the provider console or CLI. For a token tied to a person, regenerate it.
- Stop the spread. If the secret is also in a chat history, a ticket or a file, remove it there too. Removal does not undo exposure but limits further copies.
- Tell the owner. Notify whoever owns the system. Do it before you have the full picture.
Same day
- Review logs. Look at the access logs for the credential from the time it was first exposed. Look for unfamiliar sources, odd hours and unusual calls.
- Check scope. Ask what the secret could do. A read-only key to one bucket is a different event from an admin token.
- Search for copies. Check the repository history, CI variables and shared documents. A secret in one place is usually in several.
- Record the incident. Write down who, what, when, which assistant and plan, and what was done.
Fix the cause
| Cause | Fix |
|---|---|
| Log pasted with a token in it | Redact before pasting, strip tokens from log output |
| Live key in a local env file | Use a secrets manager and short-lived tokens |
| Assistant read a secret file | Add exclusions or deny rules for those paths |
| Key committed then pasted | Turn on push protection and pre-commit scanning |
| Personal account used for work | Require company accounts through admin settings |
Be careful about blame
People report mistakes faster when reporting is safe. A policy that punishes the person who confesses teaches everyone to hide the next one. Focus the review on the system that made the mistake easy.
What to put in the runbook
- Where to rotate each credential type, with direct links.
- Who to notify and how, including after hours.
- How long to watch logs afterward.
- A template for the incident record.
Practice once with a harmless test credential so the steps are not new on a bad day.
Quick check
Do I need to rotate if the assistant says it does not store data?
Yes. You cannot confirm retention from the chat window, and rotation is cheap.
Should I delete the chat?
Delete it to reduce further copies, but do not treat deletion as a substitute for rotation.
Safeguard provides compliance and evidence automation to keep incident records, and a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
