Pushed an API key to GitHub? The checklist

What to do in the first ten minutes after a key goes public, in the right order, and the four-line setup that stops it happening again.

From the skit: bots scan public GitHub for keys within minutes, and deleting the commit does not delete the key. Here is the full checklist, in order. The order matters: kill the key first, clean up after.

Right now (first 10 minutes)

Revoke the key in the provider's dashboard (OpenAI, Anthropic, Google Cloud, AWS, Stripe...). Revoke, not just "regenerate later". Assume it has already been copied.
Create a new key and give it the least access it needs.
Check the usage and billing page for anything you did not do. If there are charges, contact the provider's support now. Some will waive abuse charges if you report quickly.
Set a spending limit or budget alert on the account while you are there.
If it was a cloud key (AWS, GCP, Azure), check for new users, keys, instances or GPU machines someone else may have created. Attackers often add their own access before you notice.

Then clean up the repo

Put the new key in a .env file, never in the code.
Add .env to .gitignore, then stop tracking the old file: git rm --cached .env and commit.
Update anywhere else the old key was used: your hosting provider's environment variables (Vercel, Render, Railway...), CI secrets, teammates.
Optional: rewrite history with git filter-repo or BFG to remove the key from old commits. This tidies up, but it does not make the old key safe. Forks and clones keep the old history, so step 1 is the real fix.

So it never happens again

Keep .env in .gitignore from the first commit. The 3-file setup does this for you.
Commit a .env.example with names and no values.
Turn on GitHub push protection. It blocks a push that contains a known key format. It is on by default for public repositories; check under Settings → Code security for private ones.
Add a pre-commit secret scanner such as gitleaks, which checks before the commit is even made.
Tell your AI agent the rule in its rules file: never read, print or commit .env.
Use separate keys for development and production, each with a spending cap.

The two-minute version from the reel

Kill the old key. Make a new one. Put it in a .env file. Add .env to .gitignore.

(The $400 bill in the skit is made up for the joke. Real ones are often worse.)