Web Security · Junior · Question 72 of 75
You accidentally pushed a real API key to a public Git repository. What is the right first step?
- ✓Correct answer: Revoke or rotate the key at the provider immediately, then clean it out of the repo
- 2Delete the commit and assume nobody saw it
- 3Make the repository private and keep the key
Explanation
Bots scan public repositories for keys within minutes. Rewriting history doesn't help if the key was already copied, so it must be invalidated.