API Key, AWS Secret, or Stripe Live Token Committed to Public GitHub Repo: Automated Bot Scraping in 60 Seconds, Immediate Key Rotation, and Billing Kill-Switch¶

The instant you run git push to a public GitHub, GitLab, or Bitbucket repository (or temporarily flip a private repository to "Public" for even 10 seconds) while a file, .env configuration, Jupyter notebook (.ipynb), or older Git commit history contains a live secret key (such as an AWS Access Key ID starting with AKIA, a Stripe Live Secret Key sk_live_, an OpenAI key sk-proj-, an Anthropic key sk-ant-, or a Google Cloud service account .json), a global network of automated credential-harvesting bots intercepts that secret in 2 to 60 seconds. Because GitHub's public Events API, . GH Archive, and real-time webhook firehoses stream every public PushEvent le xexeame katã la, scraper bot vɔ̃ɖiwo tsɔa nyagbɔgblɔ siwo wozãna edziedzi dzroa wò diff me eye wodzea alilikpo me sedede siwo wowɔna le wo ɖokui si wɔwɔ gɔme hafi nàte ŋu aŋlɔ gɔ̃ hã git revert.

Le ** me.90 seconds** ƒe an AWS alo GCP adzame ƒoƒo dutoƒo repo, botnet siwo wowɔna le wo ɖokui si trɔa GPU/CPU ƒe kpɔɖeŋu siwo lolo wu (such as p4d.24xlarge or c6i.32xlarge le nuto siwo me mekɔ o me abe ap-east-1 Hong Kong, ƒe 1999 me. me-south-1 Bahrain, alo sa-east-1 Sao Paulo) yi tomenukuƒe Monero (XMR), bia AWS ƒe Email Dɔwɔƒe Blewu (SES) quota dzina ɖe edzi be woatsɔ agbã phishing spam, alo awɔ wò ame ŋutɔ ƒe nɔnɔmetata S3 buckets kple RDS nyatakakadzraɖoƒewo, si naa ** .$5,000 to $80,000+ le cloud compute ƒe fewo me le zã ɖeka me**. Nenema ke a leaked OpenAI alo Anthropic API safui la ƒoa ƒu enumake ɖe anyigba te "reverse-proxy" LLM asi siwo ɖea dɔlar akpe geɖe le token credits me le miniti ɖeka me, esime a leaked Stripe live adzame safui ( .sk_live_...) naa amedzidzelawo ɖoɖowɔɖi blibo xlẽ / ŋɔŋlɔ mɔnukpɔkpɔ be woaɖe gagbugbɔɖoɖo alakpatɔe, export asisi PII, alo aʋã Connect ƒe fexexe siwo ŋu womeɖe mɔ ɖo o. Ne amedzidzela aɖe le ga xɔm le wò habɔbɔa si vevie le esi wòtsɔ wò safui si do go la ɖe asisiwo ƒe nyatakakadzraɖoƒewo ɖa vɔ la, ke yi miaƒe nutoa me sedzikpɔlawo kple Internet dzi nudzɔdzɔwo ƒe kaƒoƒo to míaƒe... xexlẽdzesi siwo wozãna kpata directory enumake, eye nàto míaƒe mɔfiame siwo do ƒome kplii me le le vo me le nuwɔwɔ ƒe nyatakakadzraɖoƒe ƒe ɖiɖi, git force-push, kple adzame leak triage, . production database da alo S3 bucket tutui nyitsɔ laa ƒe backup manɔmee, kple adzɔge dɔwɔƒe ƒe dedienɔnɔ kple nyatakakawo ƒe adzamenyawo gbɔ kpɔkpɔ kpata.

Wɔ esia fifia¶

1. MÈGAgblẽ wò sɛkɛnd 60 gbãtɔwo le duƒuƒu me o git rm .env alo git push --force: YI NUÐEÐEŊUTI ƑE NUÐEÐEŊUTI (AWS IAM, . Stripe, . OpenAI, . GCP) EYE WOATE ŊU / DEACTIVATE KEY IN < 30 SECONDS. Fail la tutu le Git commit yeye me (or even making the GitHub repository Private) mewɔa naneke be wòatɔ te bot siwo ƒo wò safui xoxo tso GitHub Events firehose me sɛkɛnd 10 enye sia o. Ele be woawu safuia ŋutɔ le afisi wòtso gbã.
2. Ne an AWS safui (AKIA... alo ASIA...) leaked: Ʋuʋu AWS IAM -> Users -> Security credentials eye nàzi Deactivate / Delete dzi le access key la dzi enumake, emegbe nàtsɔ ** .AWSCompromisedKeyQuarantineV2** (or a blanketGbe * Gbegbe * .inline policy) na IAM zãla eye nàdzi zãla la tɔ ɖe edzi RevokeOldSessions ɖoɖo si wowɔ be woawu ɣeyiɣi kpui aɖe ƒe ame ɖesiaɖe STS dzesi siwo amedzidzela la ŋlɔ xoxo (see the exact STS bypass trap below).
3. Ne a Stripe Live Adzame Safui (sk_live_... alo rk_live_...) leaked: Yi ɖe dashboard.stripe.com/apikeys, zi ** dzi.... -> Roll key**, eye nàɖo safui xoxoa ƒe nuwuwu ɖe "Fifia (Immediately)" (NOT "in 24 hours"). Kpɔe ɖa enumake Stripe Dashboard -> Logs kple Balance -> Payouts / Refunds na API yɔyɔ siwo ŋu womeɖe mɔ ɖo o.
4. Ne an OpenAI, . Anthropic, . Google Gemini, alo SendGrid / Twilio key leaked: Tutu API safui si le provider dashboard la me enumake eye nàɖo Hard Monthly Spend Limit ($0 alo wò cap si sɔ) le Billing ƒe ɖoɖowo me be nàtso yameʋu me ƒe streaming biabiawo.
5. Klɔ Alilikpo ƒe Nutowo KAtã (especially disabled/opt-in regions) na EC2 ƒe kpɔɖeŋu alakpatɔ, Lambda ƒe dɔwɔwɔwo, ECS dɔwo, S3 buckets, kple megbeʋɔtru IAM zãla siwo bot la wɔ le miniti 2 ƒe nukpɔkpɔ fesrea me. Amedzidzelawo koŋ dzea crypto-mining ƒe kpɔɖeŋuwo gɔme le nuto siwo me mèzi le console la me gbeɖe o (like Stockholm eu-north-1, Osaka ap-northeast-3, or Mumbai ap-south-1) and create a second hidden IAM user (or SSH key pair) so they can stay inside your account after you delete the leaked key.
6. Only AFTER the secret is revoked and backdoor IAM accounts are purged, scrub the commit from Git (using git-filter-repo) AND contact GitHub Support (or remove cached PR/commit views) to purge dangling commit SHA caches, then file an AWS / GCP Accidental Leak Billing Waiver Request if bots ran up a massive cloud bill.

Decision tree: 60-Second Emergency Response by Leaked Secret Type¶

Follow this incident containment flowchart to kill the compromised credential, sever attacker persistence, and reverse runaway cloud billing.

flowchart TD
    A["Live Secret Committed to Public GitHub / GitLab Repo (.env, Source Code, or git History)"] --> B["SECOND 0 TO 30: DO NOT Run git rm First. Open Cloud/API Provider Console & REVOKE Key Immediately"]
    B --> C{"Which type of live credential was exposed?"}
    C -->|"1. AWS Access Key (AKIA... / ASIA...)"| D["1. Deactivate/Delete Key le IAM 2. Tsɔ Inline 'Deny All' Ðoɖo kpe ɖe Zãla ŋu (Ewu Minted STS Tokens) 3. Audit CloudTrail na Backdoor IAM Zãlawo"]
    C -->|"2. Stripe Live Secret Key (sk_live_... / rk_live_...)"| E["1. Roll Key kple Expiration = 'Enumake' 2. Kpɔ /v1/refunds, /v1/transfers & Webhook Endpoints 3. Da Asitsalawo ƒe PII ƒe Nukpɔkpɔwo kpɔ"]
    C -->|"3. OpenAI (sk-proj-...), Anthropic (sk-ant-...), or Gemini Key"| F["1. Revoke Key in Developer Console 2. Lower Organization Hard Billing Cap to $0 Temporarily 3. Check Usage Logs for Token Drain"]
    C -->|"4. Database URI (postgres://, mongodb+srv://) or Redis URL"| G["1. Rotate DB Password Immediately 2. Run pg_terminate_backend() / KILL to Drop Active Connections 3. Lock Down Security Group to VPC IPs Only"]
    D --> H["Du Multi-Region Compute Sweep (Tsɔ Rogue EC2 / EKS / SageMaker / Lambda le Nuto 30+ Katã me)"]
    E --> I["Kɔ Git Ŋutinya ŋu to 'git filter-repo' dzi + Klɔ GitHub Cached Commit SHA Views"]
    F --> I
    G --> I
    H --> J{"Ðe automated bots rack up $1,000 va ɖo $100,000+ cloud fetua?"}
    J -->|"Ẽ, Ẽ"| K["Ʋu AWS/GCP Fexexe ƒe Kpekpeɖeŋunya -> Ðo Dedienɔnɔ Ŋuti Numekuku le Ðɔɖɔɖo megbe + Bia Ameŋububu ƒe Ametafatafa/Leak Bill Tsɔtsɔke zi ɖeka"]
    J -->|"AO"| I

Akpa 1: Dɔwɔla-ɖe-Nudzrala Kill-Switch & Forensics Matrix (First 5 Minutes) .¶

Zã nufiame kplɔ̃ sia nàtsɔ adi asiɖeɖe le nu ŋu ƒe abɔta tututu, GitHub Secret Scanning ƒe nuwɔna le eɖokui si, kple persistence vector ɣaɣla na wò ɖaseɖigbalẽ si do go.

--- .

Part 2: Deep Dive: How to Evict an Attacker From Your AWS Account (The 4-Step Cloud Eviction Protocol) .¶

Because leaked AWS credentials carry the highest financial blast radius (up to $50,000+ per day in EC2/SageMaker/Bedrock bills), you must execute all four steps below whenever an AKIA... alo ASIA... key hits a public repository:

+-----------------------------------------------------------------------------+
|     ANATOMY OF A 60-SECOND AUTOMATED AWS GITHUB SCRAPER BOT ATTACK          |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [ SEC 00 ] Developer runs 'git push origin main' with .env (AKIA...)       |
|       |                                                                     |
|  [ SEC 04 ] Bot scrapes GitHub Events API Firehose -> Extracts AKIA key     |
|       |                                                                     |
|  [ SEC 06 ] Bot calls 'sts:GetCallerIdentity' & 'sts:GetSessionToken'       |
|       |     (Mints temporary ASIA... token that survives AKIA deletion.)    |
|       v                                                                     |
|  +----+------------------------------------------------------------------+  |
|  | [ SEC 15 TO 90: PARALLEL MULTI-REGION EXPLOITATION ]                  |  |
|  |  1. Persistence: Calls 'iam:CreateUser' / 'iam:CreateAccessKey'       |  |
|  |     (Creates hidden user 'aws-support-backup' with AdministratorAccess)|  |
|  |  2. Compute Abuse: Launches Auto-Scaling Groups of c6i.32xlarge /     |  |
|  |     g5.48xlarge in 12 regions + AWS Bedrock / SageMaker LLM endpoints |  |
|  |  3. Spam Abuse: Calls 'ses:PutAccountSendingAttributes' (50k emails)  |  |
|  |  4. Data Exfiltration: Lists & downloads S3 buckets / RDS snapshots   |  |
|  +-----------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------+

Step 1: Kill Both the Static AKIA Key AND All Minted ASIA Session Tokens¶

Deleting the AKIA key in the AWS Console does not invalidate temporary STS credentials already issued by sts:GetSessionToken. To kill everything immediately via the AWS CLI (using a separate clean admin profile):

# 1. Delete the compromised Access Key immediately
aws iam delete-access-key --user-name CompromisedUser --access-key-id AKIAIOSFODNN7EXAMPLE

# 2. Attach an explicit 'Deny All' inline policy to the IAM User to immediately
#    invalidate any STS tokens minted by that user AND block all further actions:
aws iam put-user-policy --user-name CompromisedUser --policy-name EmergencyKillSwitch \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*"
    }]
  }'

Step 2: Hunt Down Backdoor IAM Users, Roles, and Access Keys in CloudTrail¶

Run these AWS CLI commands to check whether the bot created a hidden backdoor IAM user or attached a secondary access key to one of your existing employee accounts during the window:

# List all IAM users created recently across the account
aws iam list-users --query 'Users[?CreateDate>=`2026-10-30`].[UserName,CreateDate]' --output table

# Audit CloudTrail for every API call made by the compromised user in the last 24 hours
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=CompromisedUser \
  --max-results 50 \
  --query 'Events[].[EventTime,EventName,EventSource]' --output table

Step 3: Sweep All 30+ AWS Regions for Rogue EC2 Instances, Auto Scaling Groups, and Bedrock/SageMaker Jobs¶

Why do victims still receive a $12,000 bill at the end of the month after they "checked the EC2 dashboard and saw zero instances"? Because the AWS Console only shows one region at a time (e.g., us-east-1), esime bot la nɔ tsatsam yi dzi 20 kpɔɖeŋu siwo le ** .ap-south-1 (Mumbai), . eu-north-1 (Stockholm), kple sa-east-1 (Sao Paulo)**, eye wòɣla wo ɖe EC2 Auto Scaling Groups (ASGs) so that if you terminate the EC2 instance manually, the Auto Scaling Group launches a replacement 30 seconds emegbe.

Run this multi-region bash one-liner to list all running or pending EC2 instances across every active AWS region in 10 seconds:

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "=== Checking Region: $region ==="
  aws ec2 describe-instances --region "$region" \
    --filters "Name=instance-state-name,Values=running,pending,stopped" \
    --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,LaunchTime]' \
    --output table
done

--- .

Part 3: Scrubbing the Secret From Git History (git-filter-repo) & Purging GitHub's Hidden Commit Cache¶

Once the credential is dead at the provider level, you must remove the secret string from your repository's .git commit history so neither coworkers nor future scrapers can see it (and so GitHub's Push Protection stops blocking your branches).

1. Why git rm .env + git commit Does NOT Remove the Secret From Git¶

Running git rm .env && git commit -m "remove env" only removes the file from the latest commit (HEAD); the plaintext secret remains permanently readable inside the parent commit (the parent commit) to anyone who clicks "Commits" on GitHub.

2. Rewrite the Repository History Cleanly Using git-filter-repo¶

1. If only the very last commit (HEAD) contained the secret (and nobody else has pulled it yet):

   # Remove the sensitive file from the staging index while keeping it on your local disk
   git rm --cached .env
   echo ".env" >> .gitignore
   git add .gitignore
   git commit --amend --no-edit
   git push --force-with-lease origin main
   

2. If the secret is buried several commits back in your history (or inside a code file you want to keep): Use git-filter-repo (the official, fast replacement recommended by Git and GitHub instead of the deprecated git filter-branch):

   # Option A: Completely purge a file (.env) from every commit in history
   git filter-repo --path .env --invert-paths --force
   
   # Option B: Replace a specific secret string with '***REMOVED***' across all files in history
   echo "sk_live_51NzExampleSecretKey12345==>***REMOVED***" > expressions.txt
   git filter-repo --replace-text expressions.txt --force
   
   # Force-push the rewritten history to GitHub across all branches and tags
   git push origin --force --all
   git push origin --force --tags
   

3. The Hidden GitHub Cache Trap (Dangling Commit SHAs) .¶

Even after you run git filter-repo kple git push --force, GitHub's web servers still keep the old, unreferenced ("dangling") commit SHA alive and publicly accessible at https://github.com/<owner>/<repo>/commit/<old-40-char-sha> (and in any forks or Pull Requests) until garbage collection runs. - How to Purge a Cached Commit SHA on GitHub Immediately: 1. Copy the full 40-character commit SHA of the leaked commit before you rewrote history. 2. Ʋu ** .https://support.github.com/contact** -> ask to "Remove sensitive data / Clear cached views for a unreachable commit SHA" in repository owner/repo and provide the exact commit SHA (or use the GitHub Support portal's automated cache-purge workflow).

--- .

Part 4: How to Get a $5,000 to $100,000+ AWS or GCP Bot Bill Waived (The Courtesy Forgiveness Appeal) .¶

What if you pushed an .env file on Friday afternoon, did not check your email until Monday morning, and woke up to a $28,400.00 AWS or Google Cloud bill from crypto-mining or LLM-proxy bots?

Do NOT panic, and do NOT cancel your credit card or file a bank chargeback yet. Both Amazon Web Services (AWS) and Google Cloud Platform (GCP) have an established internal One-Time Accidental Credential Leak Billing Adjustment / Courtesy Credit Policy for individual developers, students, and startups, provided you complete 100% of their mandatory security remediation checklist before their Billing Review team evaluates your appeal.

The 5-Step AWS / GCP Bill Waiver Protocol (90%+ Success Rate for First-Time Leaks) .¶

1. Complete Every Security Remediation Step First (AWS Will Reject Your Waiver Until the Account Is Clean):
   • Delete the compromised IAM Access Key (and the IAM User if possible).
   • Terminate every unauthorized EC2 instance, Auto Scaling Group, EBS volume, Elastic IP, RDS instance, and S3 bucket across all regions (verify via AWS Cost Explorer and AWS Billing -> Bills -> Charges by Region that daily accrual has dropped back to $0.00).
   • Enable Hardware or Authenticator App MFA (Multi-Factor Authentication) on your AWS Root Account and every IAM user.
2. Open a Support Case Under "Account and Billing" (Free for All AWS/GCP Tiers, No Paid Support Plan Required):
   • Go to console.aws.amazon.com/support/home -> Create case -> Account and billing -> Service: Billing -> Category: Dispute a Charge / Compromised Account.
3. Submit This Exact Factual Remediation & Hardship Summary:
   • Acknowledge the Timeline & Cause: State clearly when the key was accidentally exposed on GitHub (e.g., "October 30 at 22:14 UTC") and when it was revoked ("October 31 at 09:05 UTC").
   • Itemize the Unauthorized Charges by Region & Service: List the exact dollar amounts of the fraudulent bot activity vs. your normal historical monthly bill (e.g., "My normal monthly AWS bill for the past 8 months is $14.50/month in us-east-1; the unauthorized charges total $18,420.12 across ap-east-1, eu-north-1, and sa-east-1 EC2/Bedrock usage").
   • Confirm 100% Remediation: Bullet-point the exact steps you have already completed (1. Deleted IAM key AKIA...; 2. Terminated all unauthorized resources across all regions; 3. Audited CloudTrail for backdoor users; 4. Enabled Root & IAM MFA; 5. Configured AWS Budgets alerts).
   • Politely Request a One-Time Courtesy Billing Adjustment: Explain that you are an individual developer / student / early-stage startup, that paying an $18,420 unauthorized bot bill would cause severe financial hardship, and ask for a one-time courtesy billing credit/waiver for the fraudulent usage.
4. Temporarily Swap or Cap Your Linked Payment Card If Auto-Billing Is Imminent:
   • While your AWS Billing Support case is under review (which usually takes 5 to 15 business days while the AWS Security and Billing Service Teams verify that all rogue resources are terminated), contact AWS Support inside the ticket and ask them to place a temporary billing hold (defer auto-charge) on the disputed invoice so it does not overdraft your bank account while the credit adjustment is being processed.

(For related developer and remote-work security incidents, see Accidental production database drop, git force-push, secret leak, and incident triage, . Production database ɖiɖi alo S3 bucket tutui nyitsɔ laa ƒe backup manɔmee, . Accidentally emailed confidential payroll, client PII, or HIPAA spreadsheet, kple Emergency remote work security and data privacy.) .

--- .

Regional data breach and cloud security reporting authorities¶

--- .

Nya siwo wobiaa amewo enuenu¶

Ne mekpɔe be metutu an .env file yi dutoƒo GitHub repo me eye wòna repo la nye ame ŋutɔ tɔ le miniti 2 megbe, ɖe wògahiã kokoko be matrɔ nye safuiwoa?¶

Yes, 100 percent of the keys in that file must be Considered compromised and revoked immediately. Automated credential-harvesting bots do not wait for Google to index your repository; they subscribe directly to GitHub's real-time public `Events API` dzodoƒe ( .`and GH Archive`), si ɖea gbeƒã dutoƒo ɖesiaɖe `PushEvent` le xexeame katã le sɛkɛnd 1 va ɖo 3 me tso wò `git push`. By the time you clicked "Settings -> Change repository visibility -> Make private" two minutes later, dozens of automated scraper bots had already downloaded your commit diff and queued your AWS, Stripe, OpenAI, and database credentials for exploitation.

Nukatae bots yi edzi dze EC2 instances gɔme le nye AWS akɔnta me le esi metutu leaked vɔ megbe gɔ̃ hã AKIA access key?¶

Deleting a static `AKIA...` access key le AWS me koe IAM tsia safui ma koŋ si nɔa anyi ɖaa la nu; meɖea ɣeyiɣi kpui aɖe ƒe nuwɔna ɖa o `ASIA...` Security Token Service (`STS`) session tokens that the attacker already generated using `sts:GetSessionToken` alo `sts:AssumeRole` during the first few seconds after scraping your key (`which remain valid for up to 12 to 36 hours`). In addition, automated AWS attack scripts routinely call `iam:CreateUser` kple `iam:CreateAccessKey` in their very first second of access to plant a second, hidden backdoor administrator account. To stop an active AWS intrusion completely, you must delete the `AKIA` key, attach an explicit `Deny *` inline policy to the compromised IAM user (`which immediately invalidates all minted STS tokens`), and audit CloudTrail for any newly created IAM users or roles.

Will AWS or Google Cloud forgive a massive $10,000+ bill if hackers stole my API key from GitHub and mined crypto?¶

In the vast majority of first-time accidental leaks, yes, provided you act quickly, cooperate fully with their security team, and do not ignore the invoice. Both AWS and Google Cloud have an internal one-time courtesy billing adjustment policy for developers and small businesses hit by unauthorized credential-leak spikes. Before requesting the bill waiver under "Account and Billing" support, you must first prove that the leak is 100 percent closed: revoke the exposed IAM keys, terminate all rogue compute instances and Auto Scaling Groups across all 30+ global regions, enable Multi-Factor Authentication (`MFA`) on your root account, and set up AWS Budgets cost alerts.

Why does git rm .env not remove my secret key from GitHub?¶

Git is an immutable version-control ledger: when you run `git rm .env` and push a new commit, Git only records that the file is absent in the newest snapshot (`HEAD`), esime nèle nuŋɔŋlɔ gbadzaa me nyawo katã si le `.env` wodzrae ɖo tegbee le commit si do ŋgɔ la me (`the parent commit`) le wò nudzraɖoƒe ƒe commit ŋutinya me. Ne ègbugbɔ ŋlɔ wò ŋutinya kple... `git filter-repo` and force-push, anyone can still read the secret if you haven't revoked it at the provider console. Always revoke and rotate the secret key in your cloud provider's dashboard first, and then use `git filter-repo` to scrub the dead string from your commit history.

Mɔfiame siwo do ƒome kplii¶

• Accidental production database drop, git force-push, secret leak, and incident triage
• Production database ɖiɖi alo S3 bucket tutui nyitsɔ laa ƒe backup manɔmee
• Accidentally emailed confidential payroll, client PII, or HIPAA spreadsheet to wrong recipient
• Accidental screen share of confidential salary sheet, password manager, or layoff list on Zoom/Teams
• Emergency remote work security and data privacy
• Xexlẽdzesi siwo woatsɔ awɔ nudzɔdzɔ kpatawoe

Dzɔtsoƒewo kple dziɖuɖumegãwo ƒe mɔfiame¶

• Amazon Web Services (AWS Security Incident Response Guide & AWS Knowledge Center: "What should I do if I notice unauthorized activity or exposed IAM access keys?"): AWSCompromisedKeyQuarantineV2 Policy Behavior, Invalidation of Temporary STS Session Tokens (RevokeOldSessions), and Multi-Region Resource Auditing.
• GitHub Documentation (GitHub Secret Scanning, Push Protection, & "Removing sensitive data from a repository" using git-filter-repo): Partner Auto-Revocation Program (Stripe, AWS, OpenAI, NPM), . git-filter-repo History Rewriting, and Purging Unreachable Cached Commit SHAs.
• Stripe Inc. (Stripe Developer Security Guide: API Key Rotation & Compromised Key Incident Triage): Immediate sk_live_ Key Expiration, Auditing /v1/events kple /v1/webhook_endpoints, and Restricting Keys via rk_live_ Scopes.
• NIST (Special Publication 800-61 Rev. 2 / Rev. 3: Computer Security Incident Handling Guide) & OWASP (Secrets Management Cheat Sheet): Credential Containment, Ephemeral OIDC Workload Identity Federation (replacing static CI/CD keys), and Pre-Commit Secret Scanning.