Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAssume an exposed API key or password is compromised. Revoke, disable, or otherwise block the credential through its provider as quickly as the service allows; then investigate use, replace the credential, remove exposed copies, and check for unauthorized changes or persistence. Do not rely on deleting a value from a repository or log: cleanup does not invalidate a credential.
What “exposed” means and why speed matters
A credential is exposed when an unauthorized person could obtain it, even if you cannot prove that anyone copied or used it. Examples include a public repository, a shared ticket, a build log, a downloadable file, a client-side configuration, a paste site, or an accidentally published environment variable. Treat the exposure window as beginning when the secret became accessible and ending only when the provider confirms that the credential can no longer authenticate.
As an Amazon Associate I earn from qualifying purchases.
The correct response depends on the credential class, provider, permissions, and whether dependent systems need uninterrupted access. A password, personal access token, API key, service-account private key, OAuth client secret, and already-issued access token can have different revocation behavior. A persistent key may be disabled while an access token created from it remains valid until expiry. Use the provider’s control for the specific credential rather than applying a procedure intended for another type.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Containment is urgent, but an unplanned revocation can stop production jobs, integrations, or user access. Identify an owner for each dependent service and coordinate the order of blocking and replacement. If there is evidence of active misuse, protecting the account and its data takes priority over a perfectly staged change; document the operational risk and use the provider’s emergency controls.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
First actions in the first 15 minutes
- Open a restricted incident record. Record the credential type, provider, owner or service account, where it appeared, when it was discovered, the estimated exposure period, and systems that use it. Do not paste the secret into the ticket, chat, email, or screenshots.
- Preserve evidence without spreading the secret. Save the provider’s alert, finding identifier, timestamps, affected project or repository, and relevant log references. Limit the incident record to people who need it.
- Find the provider’s emergency control. Locate the credential-specific revoke, disable, deny, reset, or deletion action. Confirm whether it is reversible and whether it affects existing tokens.
- Notify service owners. Tell owners which applications, users, projects, or automations may fail if access is blocked. If misuse is suspected, state that containment may precede a coordinated replacement.
- Block access. Execute the provider-supported action and record the exact time, actor, credential identifier, and result. A successful change in the console is not proof that every derived token has ended; verify the provider’s behavior.
These actions establish control without waiting for a complete forensic investigation. You can expand the scope after the exposed credential is no longer accepted.
Step-by-step response
1. Identify the credential and its effective scope
Classify the secret before changing it. Record whether it is a user password, personal access token, API key, service-account key, OAuth secret, or short-lived access token. Capture the account, service identity, project, repository, application, key ID (not the secret value), permissions, creation date if available, and systems that depend on it.
Use security findings and secret-scanning alerts instead of copying the value. GitHub recommends reviewing alerts and searching audit logs for actions associated with a compromised token. Google Cloud leaked-key findings can identify the service account, key, service, method, and affected resource. Those identifiers let responders investigate while keeping the credential itself out of incident communications.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Contain access with the provider’s supported control
Choose the least destructive control that actually prevents unauthorized use:
- Revoke: permanently invalidates a token or credential when the provider supports revocation.
- Disable: blocks an identity or key while preserving it for investigation or later recovery, where the provider permits that state.
- Deny: applies an access policy that blocks requests while leaving the account or identity available for analysis.
- Delete: removes the identity or key and may be irreversible. Use it only after considering evidence preservation and dependent workloads.
- Reset or rotate: replaces a password, key, or secret with a new value. The old value must still be revoked or otherwise invalidated.
Google Cloud explains that disabling a service account affects workloads that rely on it. Its guidance also describes an IAM deny policy as a way to block access while preserving the account for investigation, and warns that deleting or disabling identities can break workloads. Assess those consequences before a destructive action.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For GitHub tokens, the revocation API accepts certain token families found exposed on GitHub or elsewhere. Revoked tokens cannot be reactivated, so generate replacements for legitimate users and integrations. Confirm the token family and the current provider documentation before calling a revocation endpoint.
3. Investigate whether the credential was used
Exposure and use are different questions. Review provider activity and audit logs for the credential, identity, or token during the entire exposure window and for a reasonable period afterward. Look for:
- Requests from unfamiliar IP addresses, regions, user agents, or autonomous systems, where the provider records them.
- Changes to users, groups, permissions, policies, keys, OAuth applications, webhooks, or security settings.
- New or modified compute instances, snapshots, storage objects, databases, service accounts, IAM users, or network rules.
- Unexpected API calls, billing spikes, data exports, downloads, or changes in request volume.
- Successful and failed authentication attempts that reveal guessing, replay, or automated probing.
For a Google Cloud leaked-key-used finding, inspect the principal, service, method, key, and affected resource, then query related logs. Search the projects and resources reachable by that identity for unfamiliar virtual machines, snapshots, service accounts, IAM changes, or other persistence. Preserve relevant log exports before retention limits remove them.
For an exposed Google API key, compare API and billing activity with expected use and add key restrictions where the service supports them. An API key is not the same credential class as a service-account private key; use the matching investigation and replacement process.
4. Create and deploy a replacement
When the old credential is not needed for immediate containment, use a staged replacement:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Create a new credential with only the permissions and scope required by the workload.
- Store it in the approved secret store or provider configuration, not in source code, logs, or a client-visible bundle.
- Deploy it to every application, job, user, and external integration that legitimately needs access.
- Verify authentication, scheduled jobs, queues, monitoring, and dependent services with the replacement.
- Revoke, disable, or delete the old credential after the replacement is confirmed, and record the completion time.
Google Cloud’s API-key procedure specifically updates applications to the new key before deleting the previous key. Its general guidance warns that replacement can cause an outage, so service owners should identify all consumers before the cutover. If active misuse makes waiting unsafe, contain first and accept a controlled interruption while owners restore service with the replacement.
Recommended Free Tools
5. Remove every known exposed copy
After access is blocked, remove the secret from the public or shared location and from known copies in source files, commit diffs, build artifacts, logs, downloads, documentation, configuration management, and local caches. Removing a visible value does not invalidate it; revocation or rotation is the control that stops authentication.
A history rewrite may be appropriate for a public repository or long-lived exposure, but it can break links to commits and disrupt collaborators, forks, automation, and cached clones. Coordinate it deliberately, notify contributors, and assume that copies may remain outside your control. Cleaning history is a distribution-control measure, not a substitute for revocation.
6. Check for reuse and broader impact
Determine whether the same password or secret was used in another system. If reuse is confirmed or plausible, rotate the dependent credentials according to their owners and permissions. For a compromised service account, Google Cloud advises rotating credentials across affected projects because resources reachable by that account may have been exposed. Scope the action to actual permissions and evidence; do not rotate unrelated systems merely to create activity.
Review identities and resources that could provide persistence. An attacker who obtained a credential may create another key, user, service account, token, webhook, forwarding rule, or permission grant. Remove unauthorized changes, preserve evidence, and recheck logs after remediation for delayed or queued activity.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
7. Document closure and prevention work
Record what was exposed, discovery and containment times, the control used, replacement details, affected systems, evidence reviewed, unauthorized actions found, and the person who approved each operational decision. Note any uncertainty, such as an unknown exposure window or incomplete logs, rather than claiming that misuse did not occur.
Use the incident to improve prevention: keep credentials out of code, use a managed secrets service, restrict API keys, minimize permissions, monitor provider activity, and establish a repeatable rotation process. OWASP recommends documenting alert contacts, containment steps, information to log, and secret lifecycle details such as access and prior rotations.
Credential-specific playbooks
| Credential type | Containment focus | Replacement and investigation notes |
|---|---|---|
| Password | Use the account provider’s reset, disablement, or session/access revocation controls. | Identify every system where the password was reused; review sign-in and account-change logs; enroll the user or service in a stronger authentication method after containment where compatible. |
| Personal access token | Revoke the token through the provider’s token control or supported revocation API. | Review repository, organization, and audit activity; issue a least-privilege replacement and update every automation that used the old token. GitHub states that revoked tokens cannot be reactivated. |
| API key | Disable, restrict, or delete the specific key through the API provider. | Compare API and billing activity with expected use, add application or API restrictions where available, deploy a replacement, and then invalidate the old key. |
| Service-account private key | Disable the key or service account, apply an access-deny control, or delete it according to the provider’s emergency guidance. | Inspect all projects and resources reachable by the account, rotate related keys where warranted, and coordinate carefully because disabling the account can stop workloads. |
| OAuth client secret | Use the provider’s client-secret rotation or revocation control and review authorized applications. | Update the application configuration, test token issuance and callbacks, then retire the old secret and inspect consent, scope, and redirect changes. |
| Already-issued access token | Use token revocation or an identity/session deny control; disabling a source key may not terminate it. | Check the provider’s lifetime and revocation semantics. Google Cloud says service-account access tokens default to up to 60 minutes and may be configured up to 12 hours under an extended lifetime policy. |
The table describes response priorities, not a universal provider procedure. Exact controls, token behavior, and audit fields vary by service and configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to rotate without causing an outage
A staged rotation is safest when there is no sign of active abuse. First inventory consumers: production services, development environments, scheduled tasks, CI/CD jobs, mobile or desktop clients, vendors, and human users. Mark which consumers can reload configuration and which require a restart or release.
- Create the replacement with an expiration, scope, and permissions that match the intended use.
- Distribute it through the approved secret-management path. Do not send it in plaintext chat or commit it to a repository.
- Deploy in a canary environment or to a small consumer group.
- Check authentication, error rates, background jobs, data writes, and monitoring.
- Roll out to the remaining consumers while retaining the old credential only for the agreed transition window.
- Revoke the old credential, verify rejection, and remove its stored copies.
If the old value is being actively abused, do not keep it valid merely to preserve a graceful transition. Block it first, communicate the expected interruption, and restore each dependency with the new credential. Keep an incident bridge or owner list so failures are assigned and resolved quickly.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Understanding short-lived tokens and persistent keys
Revoking a persistent key does not automatically guarantee that every token issued from it is invalid. Some providers evaluate a token until its expiry, while others offer a separate token-revocation or identity-deny mechanism. Ask four provider-specific questions: Does disabling the source key invalidate existing tokens? What is the maximum remaining lifetime? Can an administrator deny the principal immediately? Which logs show token use?
Google Cloud documents service-account access tokens with a default lifetime of up to 60 minutes and an extended configuration of up to 12 hours. Those figures apply to that provider’s service-account token configuration, not to passwords, API keys, or tokens issued by other services. During an incident, use the shortest practical deny or revoke control rather than waiting for a normal expiry.
Choosing between revoke, disable, deny, and delete
| Decision factor | Questions to answer | Preferred approach |
|---|---|---|
| Threat urgency | Is there evidence of active use, suspicious changes, or data access? | Use the fastest provider-supported block, even if it causes an interruption. |
| Operational impact | Which applications, users, and jobs will fail if access stops? | Stage a replacement when safe; involve service owners before disabling or deleting. |
| Evidence preservation | Will deletion remove identifiers or make investigation harder? | Prefer revocation, disablement, or deny controls when they block access without destroying the identity. |
| Reversibility | Can the action be undone, or is it permanent? | Use reversible controls during investigation unless risk demands permanent deletion. |
| Scope | What projects, accounts, data, and permissions can the credential reach? | Review reachable resources and rotate dependent credentials only where exposure is plausible. |
Common mistakes and their fixes
- Deleting the leaked line from a repository: the credential may remain in commit history, clones, logs, or downloads. Revoke or rotate it first, then clean known copies.
- Assuming no evidence means no use: review provider activity and audit logs for the full exposure window; record logging gaps.
- Disabling a service account without an owner: production workloads may fail. Identify dependencies and choose deny or staged replacement where the threat allows.
- Rotating only the visible credential: reused passwords, related keys, and accessible projects may still be exposed. Check reuse and reachable resources.
- Applying an API-key procedure to a private key: credential classes have different controls and permissions. Classify the secret before acting.
- Keeping the old credential active indefinitely: a transition window should have an owner and end time. Revoke the old value after successful cutover.
- Publishing the secret again while investigating: use key IDs, finding identifiers, timestamps, and redacted evidence instead of the secret value.
Long-term controls that reduce repeat exposure
Separate credentials from source code and application data. Store them in a managed secrets service with access logging, least-privilege policies, and controlled retrieval. Enable provider secret scanning and alerts, restrict API keys by application, API, network, or referrer where supported, and monitor billing and activity for anomalous use.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Define who can approve emergency revocation, who owns each dependent service, and where incident records live. Test replacement in a nonproduction environment and maintain a consumer inventory so rotation is a routine change rather than a search exercise.
Google Cloud recommends routinely rotating managed service-account keys at least every 90 days, with immediate rotation when compromise is suspected. That is provider-specific guidance for Google Cloud managed service-account keys, not a universal interval for every password, API key, or token. Set intervals according to credential lifetime, exposure risk, provider capabilities, and your organization’s policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
