Urufunguzo rwa API, Ibanga rya AWS, canke Stripe Live Token yiyemeje gukoresha GitHub Repo ya bose: Gukuraho Bot yikora mu masegonda 60, Guhindura urufunguzo ubwo nyene, no Gutanga amafaranga Kill-Switch¶

Ubwo nyene wiruka git push ku GitHub ya bose, GitLab, canke ububiko bwa Bitbucket (or temporarily flip a private repository to "Public" for even 10 seconds) mu gihe dosiye, .env gutunganya, akatabo ka Jupyter (.ipynb), canke amateka ya kera ya Git arimwo urufunguzo rw'ibanga ruriho (such as an AWS Access Key ID starting with AKIA, a Stripe Live Secret Key sk_live_, an OpenAI key sk-proj-, an Anthropic key sk-ant-, or a Google Cloud service account .json), a global network of automated credential-harvesting bots intercepts that secret in 2 to 60 seconds. Because GitHub's public Events API, GH Archive, and real-time webhook firehoses stream every public PushEvent globally, malicious scraper bots parse your diff with regular expressions and begin executing automated cloud commands before you can even type git revert.

Within 90 seconds ya AWS canke GCP secret hitting a public repo, automated botnets spin up maximum-size GPU/CPU instances (such as p4d.24xlarge or c6i.32xlarge across obscure regions like ap-east-1 Hong Kong, me-south-1 Bahreyini, canke sa-east-1 Sao Paulo) kugira ngo ncukure amahera (XMR), usabe AWS Serivisi yoroshe ya imeyili (SES) quota increases to blast phishing spam, or clone your private S3 buckets and RDS databases, generating $5,000 to $80,000+ in cloud compute bills overnight. Similarly, a leaked OpenAI canke Anthropic Urufunguzo rwa API ruca rushirwa mu masoko y’inyuma y’ubutaka yitwa "reverse-proxy" LLM akoresha amadolari ibihumbi n’ibihumbi mu bimenyetso ku munota, mu gihe urufunguruzo rwasohotse Stripe live secret key (sk_live_...) grants attackers full programmatic read/write access to issue fraudulent refunds, export customer PII, or trigger unauthorized Connect payouts. If an attacker is actively extorting your organization after exfiltrating customer databases with your leaked key, consult your local law enforcement and cyber incident hotlines via our inomero z'ivyihutirwa ububiko ubwo nyene, maze usubiremwo uburongozi bwacu bujanye n’ivyo ku accidental production database drop, git force-push, and secret leak triage, production database dropped or S3 bucket deleted without recent backup, na emergency remote work security and data privacy.

Ivyo ubikore ubu¶

1. NTUTAYE amasegonda 60 ya mbere wiruka git rm .env canke git push --force: GO DIRECTLY TO THE PROVIDER CONSOLE (AWS IAM, Stripe, OpenAI, GCP) AND REVOKE / DEACTIVATE THE KEY IN < 30 SECONDS. Deleting the file in a new Git commit (or even making the GitHub repository Private) does nothing to stop the bots that already scraped your key from the GitHub Events firehose 10 seconds ago. The key itself must be killed at the source first.
2. If an AWS key (AKIA... canke ASIA...) leaked: Open AWS IAM -> Users -> Security credentials hanyuma ukande Deactivate / Delete ku rufunguzo rwo gushikamwo ubwo nyene, hanyuma ushireko AWSCompromisedKeyQuarantineV2 (or a blanketGuhakana *inline policy) ku mukoresha wa IAM no kwongera ivy'ukoresha RevokeOldSessions politike yo kwica umuntu wese w'igihe gito STS ibimenyetso uwo muterabwoba yari amaze gukora (see the exact STS bypass trap below).
3. Nimba a Stripe Urufunguzo rw'ibanga ry'ubuzima (sk_live_... canke rk_live_...) yasohotse: Genda kuri dashboard.stripe.com/apikeys, kanda ... -> Roll key, and set the expiration of the old key to "Now (Immediately)" (NOT "in 24 hours"). Immediately check Stripe Dashboard -> Logs kandi Balance -> Payouts / Refunds for unauthorized API calls.
4. If an OpenAI, Anthropic, Google Gemini, canke SendGrid / Twilio key leaked: Delete the API key in the provider dashboard immediately and set a Hard Monthly Spend Limit ($0 or your normal cap) in the Billing settings to cut off in-flight streaming requests.
5. Sweep ALL Cloud Regions (especially disabled/opt-in regions) for rogue EC2 instances, Lambda functions, ECS tasks, S3 buckets, and backdoor IAM users created by the bot during the 2-minute exposure window. Attackers specifically launch crypto-mining instances in regions you never click on in the console (like Stockholm eu-north-1, Osaka ap-northeast-3, or Mumbai ap-south-1) and create a second hidden IAM user (or SSH key pair) so they can stay inside your account after you delete the leaked key.
6. Only AFTER the secret is revoked and backdoor IAM accounts are purged, scrub the commit from Git (using git-filter-repo) AND contact GitHub Support (or remove cached PR/commit views) to purge dangling commit SHA caches, then file an AWS / GCP Accidental Leak Billing Waiver Request if bots ran up a massive cloud bill.

Igiti c'ingingo: Inyishu y'ivyihutirwa y'amasegonda 60 n'ubwoko bw'ibanga ryasohotse¶

Kurikiza iki kigereranyo c'ibintu vyabaye kugira ngo wice ivyemezo vyahungabanijwe, ushireho ukwihangana kw'abatera, kandi uhindure amafaranga y'igicu yahunze.

flowchart TD
    A["Ibanga ry'ubuzima ryiyemeje kuri GitHub / GitLab Repo (.env, Kode y'inkomoko, canke amateka ya git)"] --> B["ICA KABIRI 0 KUGEZA KURI 30: NTUKORE git rm Mbere. Gufungura igicu/API umutanga Console na REVOKE urufunguzo ubwo nyene"]
    B --> C{"Ni ubuhe bwoko bw’ivyemezo vy’ubuzima bwashizwe ahabona?"}
    C -->|"1. Urufunguzo rwo kwinjira muri AWS (AKIA... / AZIYA...)"| D["1. Guhagarika/Gukuraho Urufunguzo muri IAM 2. Gufatanya Inline 'Kwanka Vyose' Politike ku Mukoresha (Ica Minted STS Tokens) 3. Gusuzuma CloudTrail ku Bakoresha Backdoor IAM"]
    C -->|"2. Urufunguzo rw'ibanga rw'ubuzima (sk_ubuzima_... / rk_ubuzima_...)"| E["1. Urufunguzo rw'uruzitiro n'Iherezo = 'Ubwo nyene' 2. Suzuma /v1/ugusubiza, /v1/uguhindura n'Iherezo rya Webhook 3. Suzuma Uko PII y'Umukiriya Yerekanwa"]
    C -->|"3. Gufungura AI (sk-umugambi-...), Ivy'abantu (sk-ibimonyo-...), canke Urufunguzo rwa Gemini"| F["1. Gukuraho urufunguzo muri Developer Console 2. Guca hasi Ishirahamwe Hard Billing Cap ku $0 mu gihe gito 3. Suzuma Inyandiko z'Ikoreshwa ku Token Drain"]
    C -->|"4. Ububiko bw'amakuru URI (inyuma y'iterambere, mongodb+srv://) canke Redis URL"| G["1. Hindukiza Ijambobanga rya DB Ubwo nyene 2. Gukoresha pg_terminate_backend() / KILL kugira ngo ushireho amahuzu akora 3. Gufunga Itsinda ry'Umutekano ku IPs za VPC gusa"]
    D --> H["Gukoresha uturere twinshi (Guhagarika ubusuma EC2/EKS/SageMaker/Lambda mu turere twose 30+)"]
    E --> I["Gukuraho amateka ya Git biciye ku 'git akayunguruzo-repo' + Gukuraho GitHub Yabitswe Ukwiyemeza SHA Ivyerekanwa"]
    F --> I
    G --> I
    H --> J{"Mbega amabots yikoresha yoba yararonse amadolari 1.000 gushika ku 100.000+ y’igicu?"}
    J -->|"EGO"| K["Gufungura AWS/GCP Billing Support Case -> Gutanga igenzura ry'umutekano inyuma y'ugusubizaho + Gusaba imbabazi z'igihe kimwe ubuhendanyi bw'ikinyabupfura/ugusohoka kw'amafaranga"]
    J -->|"OYA"| I

Igice ca 1: Uwutanga-ku-Uwutanga Kill-Switch & Matrix y'Ivy'Itohoza (First 5 Minutes)¶

Koresha iyi mbonerahamwe y'ishingiro kugira uronke ubuto nyabwo bwo gukuraho, inyifato y'Ibanga rya GitHub, n'umurongo w'ugukomeza uhishijwe w'ivyemezo vyawe vyasohotse.

Part 2: Deep Dive: How to Evict an Attacker From Your AWS Account (The 4-Step Cloud Eviction Protocol)¶

Because leaked AWS credentials carry the highest financial blast radius (up to $50,000+ per day in EC2/SageMaker/Bedrock bills), you must execute all four steps below whenever an AKIA... canke ASIA... key hits a public repository:

+-----------------------------------------------------------------------------+
|     ANATOMY OF A 60-SECOND AUTOMATED AWS GITHUB SCRAPER BOT ATTACK          |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [ SEC 00 ] Developer runs 'git push origin main' with .env (AKIA...)       |
|       |                                                                     |
|  [ SEC 04 ] Bot scrapes GitHub Events API Firehose -> Extracts AKIA key     |
|       |                                                                     |
|  [ SEC 06 ] Bot calls 'sts:GetCallerIdentity' & 'sts:GetSessionToken'       |
|       |     (Mints temporary ASIA... token that survives AKIA deletion.)    |
|       v                                                                     |
|  +----+------------------------------------------------------------------+  |
|  | [ SEC 15 TO 90: PARALLEL MULTI-REGION EXPLOITATION ]                  |  |
|  |  1. Persistence: Calls 'iam:CreateUser' / 'iam:CreateAccessKey'       |  |
|  |     (Creates hidden user 'aws-support-backup' with AdministratorAccess)|  |
|  |  2. Compute Abuse: Launches Auto-Scaling Groups of c6i.32xlarge /     |  |
|  |     g5.48xlarge in 12 regions + AWS Bedrock / SageMaker LLM endpoints |  |
|  |  3. Spam Abuse: Calls 'ses:PutAccountSendingAttributes' (50k emails)  |  |
|  |  4. Data Exfiltration: Lists & downloads S3 buckets / RDS snapshots   |  |
|  +-----------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------+

Step 1: Kill Both the Static AKIA Key AND All Minted ASIA Session Tokens¶

Deleting the AKIA key in the AWS Console does not invalidate temporary STS credentials already issued by sts:GetSessionToken. To kill everything immediately via the AWS CLI (using a separate clean admin profile):

# 1. Delete the compromised Access Key immediately
aws iam delete-access-key --user-name CompromisedUser --access-key-id AKIAIOSFODNN7EXAMPLE

# 2. Attach an explicit 'Deny All' inline policy to the IAM User to immediately
#    invalidate any STS tokens minted by that user AND block all further actions:
aws iam put-user-policy --user-name CompromisedUser --policy-name EmergencyKillSwitch \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*"
    }]
  }'

Step 2: Hunt Down Backdoor IAM Users, Roles, and Access Keys in CloudTrail¶

Run these AWS CLI commands to check whether the bot created a hidden backdoor IAM user or attached a secondary access key to one of your existing employee accounts during the window:

# List all IAM users created recently across the account
aws iam list-users --query 'Users[?CreateDate>=`2026-10-30`].[UserName,CreateDate]' --output table

# Audit CloudTrail for every API call made by the compromised user in the last 24 hours
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=CompromisedUser \
  --max-results 50 \
  --query 'Events[].[EventTime,EventName,EventSource]' --output table

Step 3: Sweep All 30+ AWS Regions for Rogue EC2 Instances, Auto Scaling Groups, and Bedrock/SageMaker Jobs¶

Why do victims still receive a $12,000 bill at the end of the month after they "checked the EC2 dashboard and saw zero instances"? Because the AWS Console only shows one region at a time (e.g., us-east-1), while the bot spun up 20 instances in ap-south-1 (Mumbai), eu-north-1 (Stockholm), na sa-east-1 (Sao Paulo), and hid them inside EC2 Auto Scaling Groups (ASGs) so that if you terminate the EC2 instance manually, the Auto Scaling Group launches a replacement 30 seconds mu nyuma.

Run this multi-region bash one-liner to list all running or pending EC2 instances across every active AWS region in 10 seconds:

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "=== Checking Region: $region ==="
  aws ec2 describe-instances --region "$region" \
    --filters "Name=instance-state-name,Values=running,pending,stopped" \
    --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,LaunchTime]' \
    --output table
done

Part 3: Scrubbing the Secret From Git History (git-filter-repo) & Purging GitHub's Hidden Commit Cache¶

Igihe ivyemezo vy'uburenganzira bipfuye ku rugero rw'umutanga, utegerezwa gukuraho urudodo rw'ibanga mu bubiko bwawe .git commit history so neither coworkers nor future scrapers can see it (and so GitHub's Push Protection stops blocking your branches).

1. Why git rm .env + . git commit Does NOT Remove the Secret From Git¶

Running git rm .env && git commit -m "remove env" only removes the file from the latest commit (HEAD); the plaintext secret remains permanently readable inside the parent commit (the parent commit) to anyone who clicks "Commits" on GitHub.

2. Rewrite the Repository History Cleanly Using git-filter-repo¶

1. If only the very last commit (HEAD) contained the secret (and nobody else has pulled it yet):

   # Remove the sensitive file from the staging index while keeping it on your local disk
   git rm --cached .env
   echo ".env" >> .gitignore
   git add .gitignore
   git commit --amend --no-edit
   git push --force-with-lease origin main
   

2. If the secret is buried several commits back in your history (or inside a code file you want to keep): Use git-filter-repo (the official, fast replacement recommended by Git and GitHub instead of the deprecated git filter-branch):

   # Option A: Completely purge a file (.env) from every commit in history
   git filter-repo --path .env --invert-paths --force
   
   # Option B: Replace a specific secret string with '***REMOVED***' across all files in history
   echo "sk_live_51NzExampleSecretKey12345==>***REMOVED***" > expressions.txt
   git filter-repo --replace-text expressions.txt --force
   
   # Force-push the rewritten history to GitHub across all branches and tags
   git push origin --force --all
   git push origin --force --tags
   

3. The Hidden GitHub Cache Trap (Dangling Commit SHAs)¶

Even after you run git filter-repo kandi git push --force, GitHub's web servers still keep the old, unreferenced ("dangling") commit SHA alive and publicly accessible at https://github.com/<owner>/<repo>/commit/<old-40-char-sha> (and in any forks or Pull Requests) until garbage collection runs. - How to Purge a Cached Commit SHA on GitHub Immediately: 1. Copy the full 40-character commit SHA of the leaked commit before you rewrote history. 2. Gufungura https://support.github.com/contact -> ask to "Remove sensitive data / Clear cached views for a unreachable commit SHA" in repository owner/repo and provide the exact commit SHA (or use the GitHub Support portal's automated cache-purge workflow).

Part 4: How to Get a $5,000 to $100,000+ AWS or GCP Bot Bill Waived (The Courtesy Forgiveness Appeal)¶

What if you pushed an .env file on Friday afternoon, did not check your email until Monday morning, and woke up to a $28,400.00 AWS or Google Cloud bill from crypto-mining or LLM-proxy bots?

Do NOT panic, and do NOT cancel your credit card or file a bank chargeback yet. Both Amazon Web Services (AWS) and Google Cloud Platform (GCP) have an established internal One-Time Accidental Credential Leak Billing Adjustment / Courtesy Credit Policy for individual developers, students, and startups, provided you complete 100% of their mandatory security remediation checklist before their Billing Review team evaluates your appeal.

The 5-Step AWS / GCP Bill Waiver Protocol (90%+ Success Rate for First-Time Leaks)¶

1. Uzuze Intambwe Yose Yo Gusubizaho Umutekano Mbere (AWS Will Reject Your Waiver Until the Account Is Clean):
   • Gukuraho urufunguzo rwo gushika ku IAM rwahungabanijwe (and the IAM User if possible).
   • Guhagarika inkuru yose ya EC2 itemerewe, Itsinda ry'Ipima ry'Ivyiyumviro, Umubare wa EBS, Elastic IP, Inkuru ya RDS, n'Indobo ya S3 mu uturere twose (verify via AWS Cost Explorer and AWS Billing -> Bills -> Charges by Region that daily accrual has dropped back to $0.00).
   • Gushoboza Ibikoresho canke Porogaramu y'Ivyemezo MFA (Multi-Factor Authentication) kuri Konti yawe y'Imizi ya AWS no ku mukoresha wese wa IAM.
2. Gufungura urubanza rwo gushigikira munsi "Account and Billing" (Free for All AWS/GCP Tiers, No Paid Support Plan Required):
   • Genda kuri console.aws.amazon.com/support/home -> Rema urubanza -> Konti n'ugutanga amafaranga -> Serivisi: Gutanga amafaranga -> Urutonde: Guhakana amafaranga / Konti yashizwe mu kaga.
3. Shereza Iyi Incamake y'Ivy'Ukuri n'Ingorane:
   • Kwemera umurongo w'igihe n'impamvu: Vuga neza igihe urufunguzo rwagaragajwe ku mpanuka kuri GitHub (e.g., "October 30 at 22:14 UTC") n’igihe ryakuweho ( )."October 31 at 09:05 UTC").
   • Itemize amafaranga ataremewe hakurikijwe akarere n'ibikorwa: Gutanga urutonde rw'amadolari nyayo y'igikorwa c'ubuhendanyi bwa bot n'amafaranga yawe asanzwe y'ukwezi (e.g., "My normal monthly AWS bill for the past 8 months is $14.50/month in us-east-1; the unauthorized charges total $18,420.12 across ap-east-1, eu-north-1, and sa-east-1 EC2/Bedrock usage").
   • Wemeze 100% Gukosora: Shira amasasu intambwe nyazo umaze kurangiza (1. Deleted IAM key AKIA...; 2. Terminated all unauthorized resources across all regions; 3. Audited CloudTrail for backdoor users; 4. Enabled Root & IAM MFA; 5. Configured AWS Budgets alerts).
   • Saba mu buryo bw’ikinyabupfura uguhindura amafaranga y’ikinyabupfura igihe kimwe: Sigura ko uri umuhinga mu bijanye n’iterambere / umunyeshure / ishirahamwe ry’intango, ko kwishura $18,420 bot bill itaremewe yotuma umuntu agira ingorane nyinshi z’amahera, kandi agasaba inguzanyo y’igihe kimwe y’ugutanga amafaranga y’ikinyabupfura kubera ikoreshwa ry’ubuhendanyi.
4. Guhindura canke gufunga ikarita yawe yo kwishura nimba Auto-Billing iri hafi:
   • Mu gihe ikibazo cawe co gufasha mu gutanga amafaranga ca AWS kiriko kirasubirwamwo (which usually takes 5 to 15 business days mu gihe amashirahamwe y’umutekano n’ugutanga amafaranga y’AWS asuzuma ko ibikoresho vyose vy’ubuhendanyi vyarangijwe), bwira abafasha ba AWS imbere mu tike maze ubasabe gushiramwo amafaranga y’igihe gito (defer auto-charge) ku nsiguro y’inyemezabuguzi kugira ngo ntiyigere irenga kuri konti yawe ya banki mu gihe uguhindura inguzanyo biriko birakorwa.

(Ku bibazo bijanye n'umutekano w'abahinguzi n'abakora kure, raba Impanuka y'ububiko bw'amakuru y'ugutemba, git inguvu-gusunika, ibanga ry'ugusohoka, n'ivyabaye gutoranya, Ububiko bw'amakuru y'umusaruro bwacitse canke indobo ya S3 yasubiwemwo ata n'imwe iherutse gusubirwamwo, Impanuka yoherejwe kuri email y'ibanga ry'imishahara, PII y'umukiriya, canke urupapuro rwa HIPAA, na Ivyihutirwa vy'akazi kure umutekano n'ubuzima bwite bw'amakuru.)

Ubuyobozi bwo gutanga raporo y'amakuru y'akarere n'umutekano wo mu gicu¶

Ibibazo bikunda kubazwa¶

Iyo mbona ko nasunikiye .env file to a public GitHub repo and made the repo private 2 minutes later, do I still need to rotate my keys?¶

Yes, 100 percent of the keys in that file must be Considered compromised and revoked immediately. Automated credential-harvesting bots do not wait for Google to index your repository; they subscribe directly to GitHub's real-time public `Events API` firehose (`and GH Archive`), which broadcasts every public `PushEvent` globally within 1 to 3 seconds of your `git push`. By the time you clicked "Settings -> Change repository visibility -> Make private" two minutes later, dozens of automated scraper bots had already downloaded your commit diff and queued your AWS, Stripe, OpenAI, and database credentials for exploitation.

Why did bots keep launching EC2 instances in my AWS account even after I deleted the leaked AKIA access key?¶

Deleting a static `AKIA...` urufunguzo rwo gushika muri AWS IAM gusa ruzimya urwo rufunguzo ruhoraho; ntibihindura ubusa ivy'igihe gito `ASIA...` Security Token Service (`STS`) ibimenyetso vy'igihe uwo muterabwoba amaze gutanga akoresheje `sts:GetSessionToken` canke `sts:AssumeRole` mu masegonda make ya mbere umaze gukuraho urufunguzo rwawe (`which remain valid for up to 12 to 36 hours`). Ikindi, inyandiko z’igitero ca AWS zikora zihora zihamagara `iam:CreateUser` kandi `iam:CreateAccessKey` in their very first second of access to plant a second, hidden backdoor administrator account. To stop an active AWS intrusion completely, you must delete the `AKIA` key, attach an explicit `Deny *` inline policy to the compromised IAM user (`which immediately invalidates all minted STS tokens`), no kugenzura CloudTrail ku bakoresha canke uruhara rwa IAM bashasha baremwe.

Will AWS or Google Cloud forgive a massive $10,000+ bill if hackers stole my API key from GitHub and mined crypto?¶

In the vast majority of first-time accidental leaks, yes, provided you act quickly, cooperate fully with their security team, and do not ignore the invoice. Both AWS and Google Cloud have an internal one-time courtesy billing adjustment policy for developers and small businesses hit by unauthorized credential-leak spikes. Before requesting the bill waiver under "Account and Billing" support, you must first prove that the leak is 100 percent closed: revoke the exposed IAM keys, terminate all rogue compute instances and Auto Scaling Groups across all 30+ global regions, enable Multi-Factor Authentication (`MFA`) on your root account, and set up AWS Budgets cost alerts.

Why does git rm .env not remove my secret key from GitHub?¶

Git is an immutable version-control ledger: when you run `git rm .env` and push a new commit, Git only records that the file is absent in the newest snapshot (`HEAD`), while keeping the full plaintext contents of `.env` permanently stored inside the previous commit (`the parent commit`) in your repository's commit history. Even if you rewrite your history with `git filter-repo` and force-push, anyone can still read the secret if you haven't revoked it at the provider console. Always revoke and rotate the secret key in your cloud provider's dashboard first, and then use `git filter-repo` to scrub the dead string from your commit history.

Inyobora zifitaniye isano¶

• Impanuka y'ububiko bw'amakuru y'ugutemba, git inguvu-gusunika, ibanga ry'ugusohoka, n'ivyabaye gutoranya
• Ububiko bw'amakuru y'umusaruro bwacitse canke indobo ya S3 yasubiwemwo ata n'imwe iherutse gusubirwamwo
• Accidentally emailed confidential payroll, client PII, or HIPAA spreadsheet to wrong recipient
• Accidental screen share of confidential salary sheet, password manager, or layoff list on Zoom/Teams
• Ivyihutirwa vy'akazi kure umutekano n'ubuzima bwite bw'amakuru
• Inomero z'ivyihutirwa

Amasoko n'ubuyobozi buzwi¶

• Amazon Web Services (AWS Security Incident Response Guide & AWS Knowledge Center: "What should I do if I notice unauthorized activity or exposed IAM access keys?"): AWSCompromisedKeyQuarantineV2 Policy Behavior, Invalidation of Temporary STS Session Tokens (RevokeOldSessions), and Multi-Region Resource Auditing.
• GitHub Documentation (GitHub Secret Scanning, Push Protection, & "Removing sensitive data from a repository" using git-filter-repo): Partner Auto-Revocation Program (Stripe, AWS, OpenAI, NPM), git-filter-repo History Rewriting, and Purging Unreachable Cached Commit SHAs.
• Stripe Inc. (Stripe Developer Security Guide: API Key Rotation & Compromised Key Incident Triage): Immediate sk_live_ Key Expiration, Auditing /v1/events kandi /v1/webhook_endpoints, and Restricting Keys via rk_live_ Scopes.
• NIST (Special Publication 800-61 Rev. 2 / Rev. 3: Computer Security Incident Handling Guide) & OWASP (Secrets Management Cheat Sheet): Credential Containment, Ephemeral OIDC Workload Identity Federation (replacing static CI/CD keys), and Pre-Commit Secret Scanning.