Postmortem: an API key leaked for nine days

Introduction

The key sat in a public repo for nine days and was scraped within hours of being pushed. We walk through detection, rotation, scope reduction, and the pre-commit and CI checks added afterward.

The mental model

• Start from the smallest version that could work, and make it observable.
• Write down the trade-off you are accepting, not only the feature you are shipping.
• Revisit the decision when the team grows; most choices in Cybersecurity have a shelf life.

A practical starting point

1. Reproduce the situation on a scratch branch, next to a measurement you trust.
2. Change one variable at a time, and keep the diff small enough to explain in one sentence.
3. Keep the result, throw away the scaffolding.

git switch -c experiment/one-thing

Closing thoughts

None of this is doctrine. Treat it as a checklist you are allowed to disagree with — ideally with an experiment of your own that settles the argument.