A real AWS key was committed and pushed. What is the correct response order?
⚡
Quick Answer
Rotate first: deactivate and reissue the key immediately, because the moment it hit a remote (or a fork/CI log) it must be treated as public — scrubbing history does not un-leak it.
Detailed Answer
Rotate first: deactivate and reissue the key immediately, because the moment it hit a remote (or a fork/CI log) it must be treated as public — scrubbing history does not un-leak it. Then check CloudTrail for use of the key. Only after rotation, rewrite history (git filter-repo/BFG) or, more pragmatically, accept the leak and rely on rotation. Finally add a pre-commit and CI GitLeaks gate so the next one never reaches a remote.
Code Example
# Deep-dive: GitLeaks # detect vs protect modes, scanning full git history vs staged changes, custom regex and entropy rules, .gitleaksignore and allowlists, pre-commit hooks, and what to do after a real key leaks (rotate first, rewrite history second) # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
💡
Interview Tip
This is where depth shows — be concrete about GitLeaks, not generic about "security".
gitleaksdevsecopsdeep-dive