# Pushed an API key to GitHub? The checklist

From solve-site-kappa.vercel.app/get/checklist


From the skit: bots scan public GitHub for keys within minutes, and deleting the commit does not delete the key. Here is the full checklist, in order. The order matters: kill the key first, clean up after.

## Right now (first 10 minutes)

- [ ] 1. **Revoke the key** in the provider's dashboard (OpenAI, Anthropic, Google Cloud, AWS, Stripe...). Revoke, not just "regenerate later". Assume it has already been copied.
- [ ] 2. **Create a new key** and give it the least access it needs.
- [ ] 3. **Check the usage and billing page** for anything you did not do. If there are charges, contact the provider's support now. Some will waive abuse charges if you report quickly.
- [ ] 4. **Set a spending limit or budget alert** on the account while you are there.
- [ ] 5. If it was a cloud key (AWS, GCP, Azure), **check for new users, keys, instances or GPU machines** someone else may have created. Attackers often add their own access before you notice.

## Then clean up the repo

- [ ] 6. Put the new key in a `.env` file, never in the code.
- [ ] 7. Add `.env` to `.gitignore`, then stop tracking the old file: `git rm --cached .env` and commit.
- [ ] 8. Update anywhere else the old key was used: your hosting provider's environment variables (Vercel, Render, Railway...), CI secrets, teammates.
- [ ] 9. Optional: rewrite history with `git filter-repo` or BFG to remove the key from old commits. This tidies up, but it does **not** make the old key safe. Forks and clones keep the old history, so step 1 is the real fix.

## So it never happens again

- **Keep `.env` in `.gitignore` from the first commit.** The [3-file setup](https://solve-site-kappa.vercel.app/blog/vibe-coding-setup-template/) does this for you.
- **Commit a `.env.example`** with names and no values.
- **Turn on GitHub push protection.** It blocks a push that contains a known key format. It is on by default for public repositories; check under Settings → Code security for private ones.
- **Add a pre-commit secret scanner** such as [gitleaks](https://github.com/gitleaks/gitleaks), which checks before the commit is even made.
- **Tell your AI agent the rule** in its rules file: never read, print or commit `.env`.
- **Use separate keys** for development and production, each with a spending cap.

## The two-minute version from the reel

Kill the old key. Make a new one. Put it in a `.env` file. Add `.env` to `.gitignore`.

(The $400 bill in the skit is made up for the joke. Real ones are often worse.)