Treat the secret as compromised, revoke it, issue a replacement, and then delete the message. Deleting first feels responsible but protects nothing, since the value may already be in search indexes, notifications, exports and other people's memory. Revocation is the only fix that holds.
Why deleting is not enough
Chat and ticket systems copy text in many ways: email notifications, mobile previews, integrations, backups, exports and plain screenshots. You cannot confirm every copy is gone. GitHub's remediation guidance makes the same point for code, saying that removing a secret and pushing a new commit does not stop it being exploited, and that you should consider any leaked secret immediately compromised.
OWASP's containment order is revoke, rotate, then delete exposed copies. Delete is last.
Response steps
- Identify the secret. What is it, what does it access, and who issued it?
- Revoke it at the issuer. If downtime is a risk, create and deploy the replacement first.
- Replace it and update the systems that need it.
- Check usage during the exposure window. See how to check whether a leaked key was used.
- Delete the message and any attachments, to limit further spread.
- Tell the poster, kindly. Blame discourages reporting, and early reporting is what you want.
- Record it with time, channel, audience size and actions taken.
Judge the exposure
| Where it was pasted | Audience | Urgency |
|---|---|---|
| Direct message to a colleague | One person | Still rotate, lower urgency |
| Private channel | Dozens | Rotate today |
| Large or public channel | Hundreds or more | Rotate now |
| Shared with external guests or vendors | Unknown | Rotate now, check their access |
| Ticket visible to customers | Unknown | Rotate now |
Fix the cause
People paste secrets because they need to share something and have no easy way. Remove that excuse:
- Provide a team password manager for people credentials and a secrets manager for machine ones. See password manager or secrets manager.
- Offer a share link with expiry rather than raw text.
- Check whether your chat tool offers secret detection or data loss controls, and turn on what exists.
- Add a line in onboarding: never paste credentials into chat or tickets.
- Scan your wikis and tickets periodically for stragglers.
Quick check
The message was up for under a minute. Do I still rotate?
Yes. You cannot know who saw it or whether an integration copied it. Rotation is cheap compared with guessing.
Should we report a pasted secret as a security incident?
Log it, at least. Many are low severity, but a record shows patterns, such as a team that lacks a safe sharing method.
You can try the free Safeguard scan on a repository, one place secrets often end up after chat.
Sources
Last reviewed: 19 October 2026.
