What Happens When an API Key Leaks
A leaked API key is used almost immediately. Automated scanners watch public repositories continuously, and one commit containing a key is typically found and tried before the developer has finished the pull request. The key does not need to survive into the final code, because it only needs to exist somewhere in the commit history.
That history point is where most developers are surprised. Removing a key in a later commit changes nothing, the repository still contains it, and a force-push to rewrite history rarely happens fast enough. The assumption that a private repository is safe fails the same way, because repositories change visibility and forks outlive their parents. One thing to keep off screen is any real credential, including expired ones and screenshots of a console showing a partially masked value.
The practice is laid out over seven scenes: one on how keys are found, one on the history problem, two on scoping and least privilege for tokens, one on where secrets should actually live, one on rotation and what a rotation plan must include, and one on what to do in the first hour after a suspected leak.
