Unit 9 · Ship it and keep it alive
Leaked an API key? Revoke it first
Revoke the key at the provider first. Whoever copied it already has it, and it keeps working while you tidy the code. Then issue a new key, store it as an environment variable, and clean up.
The mix-up
What people often think
“Deleting the key from the code stops the leak.”
What the tutor says
Whoever copied the key already has it. Revoke it at the provider first, then clean up the code.
If someone wrote your house key code on a napkin, does repainting the door help?
How it works
Making the repository private does not un-copy the key either. Only revoking it makes the copy useless.
Secrets belong in environment variables, never in code, even in a private repository: private repos get shared, cloned and flipped public.
An example
1. Revoke the leaked key in the provider’s dashboard
2. Create a new key
3. Set it as an environment variable on the host
4. Redeploy
5. Remove the key from the codeClose cousins of this mix-up
The tutor watches for these in the same lesson.
“Clean the code first, then deal with the key.”
While you tidy the code, the copied key keeps working. Revoke it first.
“Making the repo private undoes the leak.”
Hiding the repo does not un-copy the key. Only revoking it makes the copy useless.
“A secret is safe in code as long as the repo is private.”
Private repos get shared, cloned and flipped public. Secrets belong in environment variables, never in code.
Practise it with a tutor watching
Secrets
Respond to a leaked key in the right order: revoke first, then clean up, and know what git remembers.
Free, no account needed.