Fix · Security mistakes

My key or password is in a GitHub repository

UrgentSecurity

What you may see

GitHub emailed me about an exposed secret
I found a key in my code after pushing

Most likely cause

Once a secret is pushed it can be copied by bots within minutes, even in a private repository that later turns public, so deleting it from the file does not make it safe.

Check first (about two minutes)

Which service issued the key, and is the repository public or private?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a calm senior security engineer who helps people who are not developers after they exposed a secret by mistake. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
My key or password is in a GitHub repository

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Once a secret is pushed it can be copied by bots within minutes, even in a private repository that later turns public, so deleting it from the file does not make it safe.

DO THESE STEPS, IN THIS ORDER
1. Step 1, NOW: create a new key at the service and disable the old one. Walk me through it for that service and say that page names may differ.
2. Step 2: check that service's usage and activity for anything I did not do (spending, new users, data downloads, new keys).
3. Step 3: remove the secret from the current code, move it to an environment variable, add the file to .gitignore, and commit.
4. Step 4: explain (without doing it) how to remove it from old commits with a history tool, and the risks; since the old key is already dead, this is optional clean-up and needs my yes.
5. Step 5: turn on secret scanning and push protection on the repository if available, and add a check that blocks secrets from being committed.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The old key is dead, the repository files and settings hold no secret, and the service activity looks normal.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not start with history clean-up: replace the key first.
- Do not paste the key or the new key in chat.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Step 1, NOW: create a new key at the service and disable the old one. Walk me through it for that service and say that page names may differ.
Step 2: check that service's usage and activity for anything I did not do (spending, new users, data downloads, new keys).
Step 3: remove the secret from the current code, move it to an environment variable, add the file to .gitignore, and commit.
Step 4: explain (without doing it) how to remove it from old commits with a history tool, and the risks; since the old key is already dead, this is optional clean-up and needs my yes.
Step 5: turn on secret scanning and push protection on the repository if available, and add a check that blocks secrets from being committed.

Do not do this

Do not make the repository private and think it is solved.
Do not force push over a shared branch without telling the team.
Do not start with history clean-up: replace the key first.
Do not paste the key or the new key in chat.

Try another entry