Assume the credential is compromised. Revoke or rotate it with the issuing provider before editing GitHub, then replace every stored copy, remove the value from repository history and Actions evidence, investigate possible use, and verify that the old value no longer works. Deleting a key from a file, rewriting a commit, or relying on log masking does not invalidate a credential that the provider still accepts.
What to do in the first few minutes
Stop treating the value as private as soon as it appears in a repository, pull request, fork, workflow file, job log, artifact, cache, or generated output. GitHub’s incident guidance says that any credential that may have been exposed should be treated as compromised and rotated or replaced immediately.
As an Amazon Associate I earn from qualifying purchases.
- Identify the issuer and credential. Determine whether it is a cloud access key, database password, API token, webhook secret, signing key, GitHub personal access token, GitHub App credential, or another value. Record its owner, scopes, environments, expiration policy, and systems that consume it.
- Revoke or rotate at the provider. Use the provider’s security or credential-management control. If separate revoke and reissue actions exist, revoke first and create a replacement with only the required permissions.
- Limit further exposure. Pause affected deployments or workflows if they could continue sending the credential to external systems. Do not paste the value into an issue, chat, ticket, commit message, or debugging command.
- Preserve investigation evidence safely. Note the repository, branch, commit, workflow run, job, approximate exposure time, and credential owner. Preserve relevant metadata before deleting logs or alerts, but never copy the secret itself into the record.
For a compromised GitHub personal access token, delete the old token and create a new one in GitHub’s token settings. Other providers have different controls; the provider, not GitHub, determines whether the old value is still accepted.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhy deleting the GitHub copy is not rotation
A repository is only one place a credential can survive. A token may remain valid after the visible file is edited, a branch is force-pushed, or a commit is removed from the default branch. Anyone who copied the value before cleanup may also retain it. Rotation changes the credential’s state at its issuer; repository cleanup only reduces where the text can be found.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Action | What it changes | What it does not change |
|---|---|---|
| Edit the current file | Removes the value from the latest working-tree version | Older commits, forks, pull requests, logs, artifacts, caches, and provider validity |
| Rewrite Git history | Removes the value from selected commits in the rewritten repository | Clones, forks, downloaded archives, copied logs, or a credential that remains valid |
| Delete an Actions log | Removes that GitHub-hosted log from normal viewing | Copies, artifacts, external logging systems, and the credential’s validity |
| Revoke or rotate at the issuer | Causes the old credential to be rejected or replaced | Copies of the secret and historical evidence that still need investigation |
Complete rotation and replacement procedure
1. Map the credential’s identity and blast radius
Write down the provider, account or project, credential identifier, owner, scopes, environments, creation and expiration dates, and every application or workflow that uses it. Distinguish a repository-wide value from one limited to a staging environment or a single job. A broadly scoped production token requires faster containment and a wider review than a short-lived, read-only test token, but both must be treated as exposed.
Check whether the value is a static token, a refresh token, a password, a private key, a certificate, or a signed assertion. Replacing only an access token may leave a still-valid refresh token, signing key, or secondary credential able to mint new access.
2. Revoke or rotate at the issuing provider
Use the issuer’s official console or API to invalidate the old value. Select the narrowest replacement scope and, where supported, restrict it by environment, repository, IP range, audience, or permitted operation. If immediate revocation would interrupt a critical service, create the replacement, update consumers, test it, and revoke the old value as soon as the cutover is confirmed; do not leave both values active longer than necessary.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Record the exact revocation and replacement times. Provider security logs may be the only place that shows whether the old credential was used before revocation.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Replace every GitHub-held copy
Update all locations from which a workflow or deployment can obtain the value:
- Repository secrets
- Organization secrets
- Environment secrets, including production and staging environments
- Deployment-system variables and external secret stores
- Reusable-workflow inputs and caller configuration
- Local development or release automation that still references the old credential
Keep sensitive values out of workflow source files. GitHub recommends storing sensitive values as secrets and registering generated sensitive outputs as secrets as well. Search for the old value in configuration, scripts, generated files, lockfiles, documentation, test fixtures, and deployment manifests before committing the replacement.
4. Remove the value from the current tree and all affected commits
First replace the value in the current files with a secret reference or other safe mechanism. If the leak is in the latest commit and has not spread through earlier history, remove it, amend the commit, and push the corrected commit according to your repository’s protection rules.
Recommended Free Tools
If the value appears in earlier commits, remove it from every affected commit with an appropriate history-rewriting tool and coordinate the force-push with repository administrators. After rewriting, collaborators must discard or rebase old clones so the contaminated objects do not get pushed back. History rewriting is repository hygiene, not credential invalidation: complete it only after provider revocation or rotation.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Search all reachable refs, not just the default branch. Include tags, release branches, pull-request refs, merge commits, and generated source. A value can remain reachable through a tag or branch even when the main file looks clean.
5. Treat Actions logs, artifacts, and caches as exposed copies
If an unredacted value reached a workflow log, delete the affected log after preserving the run identifier and other non-secret evidence, then rotate the credential. Inspect uploaded artifacts, test reports, coverage files, deployment packages, caches, summaries, annotations, and generated output. Downloaded artifacts may already exist outside GitHub, so contact the systems or people that received them.
Do not assume masking worked because the log displays asterisks. GitHub warns that exact-value redaction can fail for structured data. A JSON, YAML, or XML object containing a secret may be transformed by formatting, escaping, line wrapping, or field concatenation before it is printed. Search for fragments, field names, encoded forms, and derived outputs as well as the exact string.
Free tools Windows power users keep installed
One-click scans. No signup required.
For values generated during a job, register the value for masking before any command can print it. A shell step can use the workflow command echo "::add-mask::$TOKEN". Masking reduces accidental display; it does not revoke a value, erase copies, or protect a secret that is written to an artifact.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Where to look for exposure
| Surface | Checks to perform | Typical containment |
|---|---|---|
| Working tree | Current files, generated files, ignored files, local build output | Remove the value and replace it with a secret reference |
| Git history | All branches, tags, reachable commits, merge commits, and release snapshots | Rewrite affected commits and coordinate the resulting force-push |
| Pull requests and forks | Diffs, comments, patch downloads, fork branches, and contributor clones | Remove the source and assume previously downloaded copies exist |
| Workflow definitions | YAML, reusable workflows, composite actions, scripts, and command arguments | Move values to secrets and minimize job access |
| Workflow logs | Every step, failed command, debug trace, summary, annotation, and retry | Preserve metadata, delete exposed logs, and rotate the credential |
| Artifacts and caches | Archives, reports, binaries, caches, test output, and deployment packages | Delete or expire copies and investigate download access |
| Third-party systems | External loggers, dashboards, ticketing systems, chat, registries, and deployment services | Request deletion or rotation where copies were forwarded |
Investigating whether someone used the credential
Separate two questions: where the value was exposed and whether the provider accepted it. Exposure alone is enough to require rotation; absence of evidence is not evidence that nobody used it.
Review GitHub evidence
- Inspect workflow runs, jobs, reruns, failed steps, and timestamps around the first exposure.
- Review job-level permissions, the effective
GITHUB_TOKENpermissions, and which repository, organization, or environment secrets were available to each job. - Check secret-scanning alerts for every location, alert state, validity indication, and resolution metadata.
- Correlate workflow-run evidence with GitHub audit-log events, including repository access, secret changes, workflow changes, and token-related administration.
- Look for unusual pushes, branch creation, pull-request activity, release downloads, artifact downloads, and changes to workflow files.
GitHub-hosted workflow logs are retained by default for 90 days. Private repositories can be configured for retention of up to 400 days, while public repositories have a 90-day maximum, according to GitHub’s 2026 documentation. Retention settings affect what you can inspect now, so capture relevant run identifiers and metadata before records expire.
Review the provider’s security records
Use the issuing provider’s access, authentication, billing, control-plane, and API logs to search from the earliest possible exposure through revocation. Compare source addresses, user agents, regions, requested operations, resource names, response codes, and volume with the normal pattern for that credential. Check for successful calls as well as rejected attempts, because a rejected request may show probing while a successful request establishes use.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Ask the provider whether revocation invalidates refresh tokens, sessions, delegated grants, signed URLs, or child credentials. If not, revoke those related objects separately. For a signing key, rotate verification keys and determine how long previously issued signatures remain trusted.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Understand which credentials expire automatically
| Credential | Lifetime behavior | Required response after exposure |
|---|---|---|
Default GITHUB_TOKEN |
Job-scoped; it expires when the job ends or at the end of its effective lifetime | Remove unnecessary permissions, inspect the run, and confirm no longer-running job can use it |
| GitHub personal access token | Remains usable until deleted, revoked, or naturally expired under its policy | Delete the compromised token and create a least-privilege replacement |
| GitHub App or installation credential | Validity follows the app’s token and installation rules | Revoke or regenerate according to the app’s controls and inspect installation access |
| Third-party API key or password | Usually remains valid until provider revocation or configured expiration | Rotate at the provider, update every consumer, and verify rejection of the old value |
| Private key or signing secret | May remain cryptographically valid even after software changes | Generate a new key, update trusted public keys or verifiers, and retire the old key |
The short lifetime of GITHUB_TOKEN does not make a leaked third-party credential safe. A workflow can expose both, and the third-party value may remain active long after the job has ended.
Validate the recovery
- Attempt a controlled operation with the old credential in a safe environment, or use the provider’s token-inspection endpoint, and confirm that it is rejected or reports revocation. Never test by making a destructive production request.
- Use the replacement credential only through its intended repository, environment, job, and operation. Confirm that read-only credentials cannot write and that staging credentials cannot reach production.
- Run the affected workflow and inspect logs, summaries, artifacts, and deployment output for accidental disclosure. Ensure the replacement is supplied through a secret reference rather than committed text.
- Check that each job has only the permissions and secrets it needs. Set explicit workflow permissions where possible and remove inherited access that is not required.
- Document the owner, exposure locations, first and last known exposure times, revocation time, replacement identifier, affected workflows, evidence reviewed, and validation result.
Prevention after the incident
Enable detection and push-time blocking
Enable Secret Protection and secret scanning wherever the repository and plan support them. Enable push protection so supported secret patterns are blocked before they reach the repository. When protection is enabled, a bypass creates a push-protection alert; review and resolve those alerts rather than treating a bypass as a permanent exception.
Secret scanning and push protection reduce recurrence risk, but they do not replace provider rotation. A scanner can alert after a value has already been copied, and push protection cannot retroactively invalidate an exposed token.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDesign workflows for least privilege
- Give each job only the repository permissions it needs.
- Expose environment secrets only to jobs that require them, with environment approval rules for sensitive deployments.
- Prefer short-lived, narrowly scoped credentials and workload identity where the provider supports it.
- Do not print secrets in commands, debug traces, test failure messages, or shell arguments.
- Mask generated tokens and JWTs before they can reach output.
- Keep structured secrets split into the minimum fields needed by the job when exact-value redaction could fail; avoid placing an entire JSON, XML, or YAML object in one secret.
- Review reusable workflows and third-party actions before passing secrets to them.
Practice an evidence-preserving response
Maintain an incident checklist that identifies credential owners, provider contacts, repository administrators, workflow owners, and the approved place for evidence. Record timestamps and identifiers without copying secret values. Define how long logs, audit records, and provider events must be retained for investigations, because GitHub’s default retention and repository settings may not cover the full period your organization needs.
Common mistakes that prolong an exposure
- Only deleting the latest file: the secret remains in earlier commits, tags, forks, logs, or artifacts.
- Rewriting history before revocation: the old value continues to work while cleanup is underway.
- Trusting asterisks in a log: masking is pattern-based and can fail after formatting or serialization.
- Rotating the repository secret but not the provider credential: a copied value remains valid outside GitHub.
- Replacing a token without checking related credentials: refresh tokens, signing keys, sessions, or delegated grants may survive.
- Giving the replacement the same broad scope: the incident is fixed, but the blast radius remains unnecessarily large.
- Deleting evidence immediately: investigators lose run IDs, timestamps, and access clues needed to correlate GitHub and provider events.
- Assuming an expired job token explains everything: third-party credentials used by that job can persist independently.
Decision guide for remediation priority
| Situation | Immediate priority | Follow-up scope |
|---|---|---|
| Production write credential in a public commit | Revoke at the provider immediately | Full history, fork, log, artifact, audit, and provider-log investigation |
| Read-only staging key in an old private commit | Rotate before continuing normal work | History cleanup, access review, and provider-log check for the exposure window |
| Unredacted value in an Actions log | Rotate even if the repository is private and the run failed | Inspect reruns, artifacts, caches, external log sinks, and log-download access |
Short-lived GITHUB_TOKEN in a completed job |
Review permissions and confirm job termination | Check run activity and any other credentials printed or passed by the job |
| Private signing key or credential that can mint other tokens | Revoke or replace the key and dependent credentials | Update verifiers, invalidate descendants, and review all signed or issued objects |
When the incident is closed
Close the incident only when the provider rejects the old value, the replacement works in its intended scope, affected repository history and current files are clean, exposed logs and artifacts are handled, investigation records are preserved, and workflow permissions have been reduced where appropriate. If any of those checks is unknown, keep the credential classified as compromised and continue the response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
