Level 2 · 2C Leaked keys · Lesson 2 of 2
A key leaked: what to do
When a key leaks, the order of your actions matters. First, cut off the attacker's access: revoke (cancel) the leaked key in the service. Then get back to normal: create a new key and store it somewhere safe, outside the code.
Next, measure the damage: check in the service for any strange activity with the old key. And finally, make sure the mistake doesn't happen again: clean up the code and add the secrets file to .gitignore.
Words worth knowing
Token: a key that gives access to a service, often temporary. Environment variable: a value stored outside the code and handed to the program when it starts. .gitignore: a list of files that git must never upload. Revoke: cancel a key so it stops working.
And one more rule: secret data never travels in the address. In https://app.com/entrar?usuario=ana&clave=Gato2026 ("usuario" means user and "clave" means password), the password stays in the browser history, in the server logs, and in any link that gets shared. API keys go in a header or in the body of the request, not in the address.
Going deeper
Catch it before it happens
There are tools that scan your code for keys before you upload it (they're called "secret scanners"), and services that alert you if one of your keys shows up in a public repository. Turning them on is cheap and saves you the scare.
Review questions
What does it mean to "revoke" a key?
Answer: Cancel it so it stops working. Revoking cuts off access for whoever has it, even if they copied it. It's the first step after a leak.
A payments key leaked. What's the right order?
Answer: Revoke the key, create a new one stored outside the code, check activity, and prevent it from happening again. First you cut off access, then you get back to normal with a new key, and finally you review and prevent.
The address is https://api.com/datos?api_key=sk_live_123. What's wrong with it?
Answer: The key travels in the address: it ends up in histories and logs. Addresses get saved and shared. Secrets go in a header of the request, not in the address.