How to Fix a Leaked API Key: A Developer's Guide to Git Security
Content is AI-assisted and may contain inaccuracies.
A key committed to Git should be treated as compromised immediately: history and automated scanners preserve and surface old revisions even after the line is deleted.
The guide follows a five-stage workflow — invalidate, investigate, remove, replace, prevent. It covers revoking the credential, checking provider logs for unauthorized usage, and moving secrets into .env files excluded by .gitignore. For secrets already in history, it explains git filter-repo and BFG cleanup, verification with git log -S, and hardening with scoped keys, secret scanning, and pre-commit hooks.