/
Menu

Leaked key

Replace a key or password that may have been exposed, revoke the old one right away and check the provider for misuse.

Use the Leaked key playbook when a value may have been exposed: committed to a repository, pasted into a chat, printed in a log, or seen by an AI agent. It is the Rotate playbook with a first step to find the leak and a last step to check for misuse, and its revoke step is urgent.

#Before you start

  • Unlock your vault. See Unlock your vault.
  • Don't paste the value anywhere new while you look for the leak.

#Start a run

Open the item and choose I think this leaked. This works for a key, login, secure note, certificate or database credential. If a run for the item is already in progress, the button reads Resume leak response. See Runs.

If other items hold the same value, the start screen lists them. The run replaces the value in each of them, and revoking it once at the provider covers all of them. A run covers up to 50 items.

If an item shows a notice that an AI agent created or saw its value, treat that value as exposed and start this playbook.

#Steps

  1. Find where it leaked. Optional. Check your repository, logs and chat for the value and remove it.
  2. Generate a new key at the provider, with the same permissions as the old one. If an agent created or saw the value, the step says so.
  3. Save the new value in StackHangar. Paste it, pick a Reminder and choose the save button. It is encrypted on your device.
  4. Update it in each place the item says it is used. Optional.
  5. Push the variable to each deploy target and redeploy. Both are optional. See Deploy targets.
  6. Verify it works.
  7. Revoke the leaked key now. Do this as soon as the new one works. Until the old one is revoked, anyone who has it can still use it. For a database it reads Cut off the leaked password now. If several items share the value, revoking once covers them: tick each one.
  8. Check the provider for misuse. Optional. Look through the usage or audit logs since the leak for anything you don't recognize.

Steps after the first few show Waiting until the steps they depend on are done or skipped.

#Finish

Finish closes the run and shows a summary: what was saved, where it was sent, whether the old value was revoked and each item's current reminder. If the old value wasn't revoked, the summary says so in a warning.

#If something goes wrong

  • If sending to a deploy target fails, do that step by hand. See Deploy targets.
  • If you can't revoke the old value yet, leave the run open. It stays under In progress.