A database password was committed. Deleting the line won't help.

transcript

A live API key and the database admin password. In a config file. In main for 3 hours. In production for 2.

A pull request adds an analytics integration. The secrets come with it. The security bot fires: credential detected in commit. But it was merged to main 3 hours ago. And deployed to production 2 hours ago.

The developer pushes a fix. The password is deleted from the file. Done? Not even close.

It's in git history. Forever, unless force-pushed. In the Docker image layers, pushed to the registry. In the CI and CD logs, visible to the team. On every laptop that pulled. In every fork.

No commit can recall those copies. Not even a history rewrite. So rotate the credential. That makes the leaked value useless.

Then fix why it happened. Secrets never go in config files, images, or environment variables. They live in a vault. Fetched at runtime, rotated, and audited.

Once pushed, a secret has copies you can't chase down. Don't just delete it. Rotate it.

Full breakdown in the lecture.