API Kiyi, AWS Chakavanzika, kana Stripe Live Chiratidzo Yakazvipira kune Ruzhinji GitHub Repo: Otomatiki Bot Kukwenya muMasekondi makumi matanhatu, Nekukurumidza Kiyi Kutenderera, uye Kubhadhara Kuuraya-Chinja¶

Pakarepo unomhanya git push kune yeruzhinji GitHub, GitLab, kana Bitbucket repository (or temporarily flip a private repository to "Public" for even 10 seconds) apo faira, .env gadziriro, Jupyter notebook (.ipynb), kana yekare Git kuzvipira nhoroondo ine live chakavanzika kiyi (such as an AWS Access Key ID starting with AKIA, a Stripe Live Secret Key sk_live_, an OpenAI key sk-proj-, an Anthropic key sk-ant-, or a Google Cloud service account .json), network yepasi rose yeautomated credential-harvesting bots inobata chakavanzika mu 2 kusvika 60 seconds. Nekuti GitHub yeruzhinji Events API, GH Archive, uye chaiyo-nguva webhook firehoses inoyerera ruzhinji rwese PushEvent pasi rose, hutsinye h git revert.

Mukati 90 seconds zve an AWS kana GCP secret hitting a public repo, automated botnets spin up maximum-size GPU/CPU instances (such as p4d.24xlarge or c6i.32xlarge across obscure regions like ap-east-1 Hong Kong, me-south-1 Bahrain, or sa-east-1 Sao Paulo) to mine Monero (XMR), request AWS Simple Email Service (SES) quota increases to blast phishing spam, or clone your private S3 migomo uye RDS databases, kugadzira $5,000 to $80,000+ mugore kota mabhiri husiku. Saizvozvo, a leaked OpenAI kana Anthropic API kiyi inokurumidza kuunganidzwa mukati mepasi pevhu "reverse-proxy" LLM misika inodonhedza zviuru zvemadhora mumatokeni emakiredhi paminiti, uku ichidonha. Stripe live secret key (sk_live_...) grants attackers full programmatic read/write access to issue fraudulent refunds, export customer PII, kana kuunza mari isina kubvumidzwa Connect payout. Kana munhu anorwisa ari kubira sangano rako mushure mekubudisa dhatabhesi revatengi nekiyi yako yadeuka, bvunza vezvemutemo munharaunda yako uye cyber chiitiko hotline kuburikidza neyedu. nhamba dze emergency directory immediately, and review our related guides on netsaona yekugadzira dhatabhesi inodonha, git simba-push, uye chakavanzika leak triage, dhizaini yekugadzira yakadonha kana S3 bhaketi radzimwa pasina ichangoburwa backup,uye emergency emergency basa rekuchengetedza uye kuvanzika kwedata.

Ita izvi ikozvino¶

1. ** USAtambise yako yekutanga 60 masekonzi uchimhanya git rm .env kana git push --force: ENDA ZVINHU KUNE PROVIDER CONSOL (AWS IAM, Stripe, OpenAI, GCP) AND REVOKE / DEACTIVATE THE KEY IN < 30 SECONDS.** Deleting the file in a new Git commit (or even making the GitHub repository Private) haite ** hapana ** kumisa mabhoti akatokwenya kiyi yako kubva kuGitHub Zviitiko firehose masekonzi gumi apfuura. Kiyi pachayo inofanira kuuraiwa patsime kutanga.
2. If an AWS key (AKIA... kana ASIA...) leaked: Open AWS IAM -> Users -> Security credentials and click Deactivate / Delete on the access key immediately, then attach the AWSCompromisedKeyQuarantineV2 (or a blanketDeny *inline policy) to the IAM user and increment the user's RevokeOldSessions policy to kill any temporary STS tokens the attacker already minted (see the exact STS bypass trap below)
3. If a Stripe Live Secret Key (sk_live_... kana rk_live_...) leaked: Go to dashboard.stripe.com/apikeys, click ... -> Roll key, and set the expiration of the old key to "Now (Immediately)" (NOT "in 24 hours"). Immediately check Stripe Dashboard -> Logs uye Balance -> Payouts / Refunds for unauthorized API calls.
4. If an OpenAI, Anthropic, Google Gemini, kana SendGrid / Twilio key leaked: Delete the API key in the provider dashboard immediately and set a Hard Monthly Spend Limit ($0 or your normal cap) in the Billing settings to cut off in-flight streaming requests.
5. Sweep ALL Cloud Regions (especially disabled/opt-in regions) for rogue EC2 instances, Lambda functions, ECS tasks, S3 buckets, and backdoor IAM users created by the bot during the 2-minute exposure window. Attackers specifically launch crypto-mining instances in regions you never click on in the console (like Stockholm eu-north-1, Osaka ap-northeast-3, or Mumbai ap-south-1) and create a second hidden IAM user (or SSH key pair) so they can stay inside your account after you delete the leaked key.
6. Only AFTER the secret is revoked and backdoor IAM accounts are purged, scrub the commit from Git (using git-filter-repo) AND contact GitHub Support (or remove cached PR/commit views) to purge dangling commit SHA caches, then file an AWS / GCP Accidental Leak Billing Waiver Request if bots ran up a massive cloud bill.

Muti wesarudzo: 60-Yechipiri Emergency Response neLeaked Secret Type¶

Tevedza chiitiko ichi chinoyerera chechati kuti uuraye chiziviso chakakanganisika, sever attacker kushingirira, uye kudzosera kumashure kubhadharisa kwegore.

flowchart TD
    A["Rarama Chakavanzika Chakazvipira kune Ruzhinji GitHub / GitLab Repo (.env, Source Code, kana git Nhoroondo)"] --> B["CHECHIPIRI 0 KUSVIKA 30: USAMhanya git rm Kutanga. Vhura Cloud/API Provider Console & REVOKE Kiyi Pakarepo"]
    B --> C{"Ndeupi rudzi rwechiratidzo chekurarama chakafumurwa?"}
    C -->|"1. AWS Access Key (AKIA... / ASIA...)"| D["1. Deactivate/Delete Key muIAM 2. Batanidza Inline 'Ramba Zvose' Policy kumushandisi (Inouraya Minted STS Tokens) 3. Ongorora CloudTrail yeBackdoor IAM Users"]
    C -->|"2. Stripe Live Chakavanzika Kiyi (sk_live_... / rk_live_...)"| E["1. Roll Key with Expiration = 'Pakarepo' 2. Tarisa /v1/kudzorera, /v1/transfers & Webhook Endpoints 3. Ongorora Mutengi PII Exposure"]
    C -->|"3. OpenAI (sk-proj-...), Anthropic (sk-ant-...), kana Gemini Key"| F["1. Kanzura Kiyi muDeveloper Console 2. Yepasi Yesangano Yakaomesesa Kubhadharisa Cap kusvika pa $0 Nenguva 3. Tarisa Mashandisiro Logs eToken Drain"]
    C -->|"4. Database URI (postgres://, mongodb+srv://) kana Redis URL"| G["1. Tenderedza DB Password Pakarepo 2. Mhanya pg_terminate_backend() / KILL kuti Udonhedze MaConnections Anoshanda 3. Kiya Pazasi Security Group kuVPC IPs Chete"]
    D --> H["Mhanya Multi-Region Compute Sweep (Kumisa Rogue EC2/EKS/SageMaker/Lambda muMatunhu ese makumi matatu)"]
    E --> I["Purge Git Nhoroondo kuburikidza ne 'git filter-repo' + Bvisa GitHub Cached Commit SHA Views"]
    F --> I
    G --> I
    H --> J{"Ko automated bots yakasimudza $1,000 kusvika $100,000+ cloud bill?"}
    J -->|"YES"| K["Vhura AWS/GCP Yekubhadharisa Nyaya Yekubhadharisa -> Tumira Post-Remediation Chengetedzo Odhita + Kumbira Imwe-Nguva Yekubiridzira Kubiridzira / Leak Bill Ruregerero"]
    J -->|"NO"| I

Chikamu 1: Provider-by-Provider Kill-Switch & Forensics Matrix (First 5 Minutes)¶

Shandisa iyi tafura yereferensi kuti uwane bhatani chairo rekudzosa, otomatiki GitHub Chakavanzika Kuongorora maitiro, uye yakavanzika yekushingirira vector kune yako yakaburitswa.

Chikamu 2: Dive Yakadzika: Maitiro ekudzinga Anorwisa kubva kuAWS Account yako (The 4-Step Cloud Eviction Protocol)¶

Nokuti leaked AWS zvitupa zvinotakura yakanyanya kuputika radius yemari (up to $50,000+ per day in EC2/SageMaker/Bedrock bills), unofanira kuita nhanho ina dziri pazasi pese pa AKIA... kana ASIA... kiyi inobaya nzvimbo yeruzhinji:

+-----------------------------------------------------------------------------+
|     ANATOMY OF A 60-SECOND AUTOMATED AWS GITHUB SCRAPER BOT ATTACK          |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [ SEC 00 ] Developer runs 'git push origin main' with .env (AKIA...)       |
|       |                                                                     |
|  [ SEC 04 ] Bot scrapes GitHub Events API Firehose -> Extracts AKIA key     |
|       |                                                                     |
|  [ SEC 06 ] Bot calls 'sts:GetCallerIdentity' & 'sts:GetSessionToken'       |
|       |     (Mints temporary ASIA... token that survives AKIA deletion.)    |
|       v                                                                     |
|  +----+------------------------------------------------------------------+  |
|  | [ SEC 15 TO 90: PARALLEL MULTI-REGION EXPLOITATION ]                  |  |
|  |  1. Persistence: Calls 'iam:CreateUser' / 'iam:CreateAccessKey'       |  |
|  |     (Creates hidden user 'aws-support-backup' with AdministratorAccess)|  |
|  |  2. Compute Abuse: Launches Auto-Scaling Groups of c6i.32xlarge /     |  |
|  |     g5.48xlarge in 12 regions + AWS Bedrock / SageMaker LLM endpoints |  |
|  |  3. Spam Abuse: Calls 'ses:PutAccountSendingAttributes' (50k emails)  |  |
|  |  4. Data Exfiltration: Lists & downloads S3 buckets / RDS snapshots   |  |
|  +-----------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------+

Nhanho 1: Uraya ese ari maviri Static AKIA Key AND All Minted ASIA Session Tokens¶

Deleting the AKIA kiyi muAWS Console haina ** kwete ** kusashanda kwenguva pfupi STS zvitupa zvakatoburitswa na sts:GetSessionToken. Kuuraya zvese nekukurumidza kuburikidza neAWS CLI (using a separate clean admin profile):

# 1. Delete the compromised Access Key immediately
aws iam delete-access-key --user-name CompromisedUser --access-key-id AKIAIOSFODNN7EXAMPLE

# 2. Attach an explicit 'Deny All' inline policy to the IAM User to immediately
#    invalidate any STS tokens minted by that user AND block all further actions:
aws iam put-user-policy --user-name CompromisedUser --policy-name EmergencyKillSwitch \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*"
    }]
  }'

Danho 2: Hunt Down Backdoor IAM Users, Mabasa, uye Access Keys mu CloudTrail¶

Mhanya iyi AWS CLI mirairo kuti uone kana bot yakagadzira yakavanzika yekumashure IAM mushandisi kana yakanamatira kechipiri yekuwana kiyi kune imwe yako iripo yevashandi maakaundi pahwindo:

# List all IAM users created recently across the account
aws iam list-users --query 'Users[?CreateDate>=`2026-10-30`].[UserName,CreateDate]' --output table

# Audit CloudTrail for every API call made by the compromised user in the last 24 hours
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=CompromisedUser \
  --max-results 50 \
  --query 'Events[].[EventTime,EventName,EventSource]' --output table

Danho rechitatu: tsvaira zvese 30+ AWS Matunhu eRogue EC2 Zviitiko, Auto Scalling Mapoka, uye Bedrock/SageMaker Mabasa.¶

Sei vakabatwa vachiri kugamuchira a $12,000 bhiri pakupera kwemwedzi mushure mekunge "vatarisa EC2 dashboard ndokuona zero kesi"? Nekuti iyo AWS Console inongoratidza ** dunhu rimwe panguva ** (e.g., us-east-1), uku bot ichitenderera 20 zviitiko mu ap-south-1 (Mumbai), eu-north-1 (Stockholm), uye sa-east-1 (Sao Paulo), ndokuvaviga mukati EC2 Auto Scaling Groups (ASGs) zvekuti kana ukamisa EC2 muenzaniso nemawoko, Auto Scaling Group inotangisa kutsiva. 30 seconds gare gare.

Mhanya iyi yakawanda-region bash one-liner kunyora ** ese arikumhanya kana akamirira EC2 zviitiko munharaunda yese inoshanda yeAWS ** mu 10 seconds:

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "=== Checking Region: $region ==="
  aws ec2 describe-instances --region "$region" \
    --filters "Name=instance-state-name,Values=running,pending,stopped" \
    --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,LaunchTime]' \
    --output table
done

Chikamu 3: Kukwesha Chakavanzika Kubva Git Nhoroondo (git-filter-repo) & Kuchenesa GitHub's Yakavanzika Commit Cache¶

Kana chiziviso chafa padanho rekupa, iwe unofanirwa kubvisa tambo yakavanzika kubva kune yako repository .git ita nhoroondo kuitira kuti vaunoshanda navo kana ramangwana scrapers vaone (and so GitHub's Push Protection stops blocking your branches)

1. Nei git rm .env + git commit Haisi Kubvisa Chakavanzika Kubva kuGit¶

Kumhanya git rm .env && git commit -m "remove env" inongobvisa iyo faira kubva ku ** ichangoburwa kuzvipira (HEAD)**; chakavanzika chezvinyorwa chinoramba chichiverengwa zvachose mukati mekuzvipira kwemubereki (the parent commit) kune chero munhu anodzvanya "Commits" paGitHub.

2. Nyorazve Repository Nhoroondo Yakachena Uchishandisa git-filter-repo¶

1. Kana chete kuzvipira kwekupedzisira (HEAD) yaiva nezvakavanzika (and nobody else has pulled it yet):

   # Remove the sensitive file from the staging index while keeping it on your local disk
   git rm --cached .env
   echo ".env" >> .gitignore
   git add .gitignore
   git commit --amend --no-edit
   git push --force-with-lease origin main
   

2. ** Kana chakavanzika chakavigwa akati wandei anodzokera munhoroondo yako (or inside a code file you want to keep):** Shandisa git-filter-repo (the official, fast replacement recommended by Git and GitHub instead of the deprecated git filter-branch):

   # Option A: Completely purge a file (.env) from every commit in history
   git filter-repo --path .env --invert-paths --force
   
   # Option B: Replace a specific secret string with '***REMOVED***' across all files in history
   echo "sk_live_51NzExampleSecretKey12345==>***REMOVED***" > expressions.txt
   git filter-repo --replace-text expressions.txt --force
   
   # Force-push the rewritten history to GitHub across all branches and tags
   git push origin --force --all
   git push origin --force --tags
   

3. Iyo Yakavanzika GitHub Cache Trap (Dangling Commit SHAs)¶

Kunyangwe mushure mekumhanya git filter-repo uye git push --force, GitHub's web servers achiri kuchengeta yekare, isina kutaurwa ("yakarembera") inoita SHA mhenyu uye inowanikwa pachena https://github.com/<owner>/<repo>/commit/<old-40-char-sha> (and in any forks or Pull Requests) kusvikira kuunganidzwa kwemarara kwapera. - ** Maitiro ekubvisa Cached Commit SHA paGitHub Pakarepo: ** 1. Kopa zvizere 40-character ita SHA yechibvumirano chakaburitswa usati wanyora nhoroondo. 2. Vhura https://support.github.com/contact -> bvunza ku "Bvisa data rakadzama / Bvisa mawonero akavharidzirwa kune isingasvikike kuzvipira SHA" mune repository owner/repo uye ipa chaiyo kuzvipira SHA (or use the GitHub Support portal's automated cache-purge workflow)

Chikamu 4: Matorero A $5,000 to $100,000+ AWS kana GCP Bot Bill Yakaregererwa (The Courtesy Forgiveness Appeal)¶

Ko kana ukasunda .env faira neChishanu masikati, handina kutarisa email yako kusvika Muvhuro mangwanani, uye ndakamuka ku **$28,400.00 AWS kana Google Cloud bill ** kubva ku crypto-mining kana LLM-proxy bots?

Usavhunduke, uye USAdzima kadhi rako rechikwereti kana kufaira kubhengi kudzosera kumashure. Ose Amazon Web Services (AWS) uye Google Cloud Platform (GCP) iva neyakagadziriswa yemukati **Imwe-Nguva Yetsaona Yekuvuza Kubhadhara Kugadziriswa / Ruremekedzo Chikwereti Policy ** yevagadziri vega, vadzidzi, uye vanotanga, ** chero ** iwe wapedza. 100% yeavo vanosungirwa kuchengetedza kugadzirisa cheki * pamberi * yavo Yekubhadharisa Ongororo timu inoongorora chikumbiro chako.

Iyo 5-Nhanho AWS / GCP Bill Waiver Protocol (90%+ Success Rate for First-Time Leaks)¶

1. ** Pedzisa Yese Chengetedzo Remediation Danho Kutanga (AWS Will Reject Your Waiver Until the Account Is Clean):**
   • Dzima iyo yakakanganiswa IAM Access Key (and the IAM User if possible)
   • Kumisa ese asina kutenderwa EC2 muenzaniso, Auto Scaling Group, EBS vhoriyamu, Elastic IP, RDS muenzaniso, uye S3 bhaketi kumativi ose ** matunhu ese** (verify via AWS Cost Explorer and AWS Billing -> Bills -> Charges by Region that daily accrual has dropped back to $0.00)
   • Gonesa ** Hardware kana Authenticator App MFA (Multi-Factor Authentication) ** pane yako ** AWS Root Account ** uye yega yega IAM mushandisi.
2. Vhura Nyaya Yekutsigira Pasi "Account and Billing" (Free for All AWS/GCP Tiers, No Paid Support Plan Required):
   • Go to console.aws.amazon.com/support/home -> **Gadzira nyaya ** -> **Akaunti uye kubhadharisa ** -> Sevhisi: ** Kubhadharisa ** -> Chikamu: ** Kakavara neCharge / Yakakanganiswa Akaunti **.
3. Tumira Iyi Yechokwadi Yekugadzirisa & Kuomerwa Pfupiso:
   • ** Bvuma Nguva & Chikonzero:** Taura zvakajeka apo kiyi yakafumurwa netsaona paGitHub (e.g., "October 30 at 22:14 UTC") uye payakabviswa ("October 31 at 09:05 UTC")
   • Itemize Mhosva Dzisina Kutenderwa neNharaunda & Sevhisi: Nyora dhora chairo rekuita kwehutsotsi hwemabhoti maringe neyakajairwa bhiri yako yepamwedzi.e.g., "My normal monthly AWS bill for the past 8 months is $14.50/month in us-east-1; the unauthorized charges total $18,420.12 across ap-east-1, eu-north-1, and sa-east-1 EC2/Bedrock usage")
   • Simbisa 100% Remediation: Bullet-nongedza matanho chaiwo awakapedza kare (1. Deleted IAM key AKIA...; 2. Terminated all unauthorized resources across all regions; 3. Audited CloudTrail for backdoor users; 4. Enabled Root & IAM MFA; 5. Configured AWS Budgets alerts)
   • ** Kumbira Nehuremekedzo Kugadziridzwa Kwekubhadhara Kwenguva Imwe:** Tsanangura kuti uri wega mugadzirisi / mudzidzi / nhanho yekutanga, inobhadhara $18,420 bhiri rebhoti risina kutenderwa rinokonzera kuoma kwemari kwakanyanya, uye kumbira ** yenguva imwe chete yeruremekedzo yekubhadhara chikwereti / waiver ** yekushandiswa kwechitsotsi.
4. ** Chinjana Kwenguva pfupi kana Kuvhara Kadhi Yako Yekubhadhara Yakabatana Kana Kubhadharira Kwega Kwava Pedyo:**
   • Ipo yako AWS Billing Support kesi iri kuongororwa (which usually takes 5 to 15 business days nepo AWS Security uye Billing Service Teams vachiona kuti zviwanikwa zvese zvine hutsinye zvakamiswa), taura neAWS Support mukati metikiti uye uvakumbire kuti ** isa mari yekubhadharisa kwenguva pfupi (defer auto-charge)** painvoice yamakapokana kuti isawedzere mari muakaundi yako yekubhangi uku kugadziridzwa kwechikwereti kuchigadziriswa.

(Kune hukama hwekuvandudza uye kure-basa kuchengetedza zviitiko, ona Tsaona yekugadzira dhatabhesi inodonha, git simba-push, chakavanzika kuvuza, uye chiitiko triage, Yekugadzira dhatabhesi yakadonha kana S3 bhaketi radzimwa pasina ichangoburwa backup, Netsaona yakatumirwa email payroll, mutengi PII, kana HIPAA spreadsheet,uye Emergency kure kure kuchengetedza basa uye kuvanzika kwedata.)

Kutyora kwedunhu data uye cloud chengetedzo yekuzivisa zviremera¶

Mibvunzo inowanzo bvunzwa¶

Kana ndakaona kuti ndasundidzira .env faira kune yeruzhinji GitHub repo uye akaita iyo repo yakavanzika 2 maminetsi gare gare, ndichiri kuda kutenderedza makiyi angu?¶

Hongu, 100 muzana yemakiyi mune iyo faira inofanirwa Kuonekwa seyakakanganiswa uye kukanzurwa nekukasira. Otomatiki credential-kukohwa bots usamirire kuti Google inyore yako repository; vanonyoresa zvakananga kuGitHub's real-time public `Events API` firehose (`and GH Archive`), iyo inotepfenyura veruzhinji `PushEvent` pasi rose mukati me1 kusvika ku3 seconds kubva kwauri `git push`. Panguva yawakadzvanya "Settings -> Shandura repository kuoneka -> Gadzira zvakavanzika" maminetsi maviri gare gare, akawanda eautomated scraper bots anga atodhawunirodha yako diff uye akamisa yako AWS, Stripe, OpenAI, uye dhatabhesi zvinyorwa zvekushandisa.

Nei bots yakaramba ichivhura EC2 zviitiko muAWS account yangu kunyangwe ndadzima iyo yakaburitswa AKIA kiyi yekupinda?¶

Kudzima static `AKIA...` kiyi yekuwana muAWS IAM inongodzima iyo chaiyo kiyi yekusingaperi; hazvikodzeri zvenguva pfupi `ASIA...` Chengetedzo Token Service (`STS`) sesheni tokeni dzakatogadzirwa neanorwisa achishandisa `sts:GetSessionToken` kana `sts:AssumeRole` mumasekonzi mashoma ekutanga mushure mekukwenya kiyi yako (`which remain valid for up to 12 to 36 hours`) Uye zvakare, otomatiki AWS kurwisa zvinyorwa zvinogara zvichifona `iam:CreateUser` uye `iam:CreateAccessKey` musekondi yavo yekutanga yekuwana kudyara yechipiri, yakavanzika backdoor administrator account. Kuti umise kushanda kweAWS kupindira zvachose, unofanira kudzima `AKIA` kiyi, batanidza zvakajeka `Deny *` inline mutemo kune yakakanganisika IAM mushandisi (`which immediately invalidates all minted STS tokens`), uye ongorora CloudTrail kune chero ichangobva kugadzirwa IAM vashandisi kana mabasa.

Ko AWS kana Google Cloud icharegerera yakakura $10,000+ bhiri kana matsotsi akaba kiyi yangu yeAPI kubva kuGitHub uye kucherwa crypto?¶

Muhuwandu hwakawanda hwekudonha kwetsaona kekutanga, hongu, chero ukaita nekukurumidza, shandira pamwe zvizere nechikwata chavo chekuchengetedza, uye usazeye iyo invoice. Ose ari maviri AWS neGoogle Cloud ane yemukati-yenguva-yenguva yeruremekedzo gadziriso yemitemo yevagadziri uye mabhizinesi madiki anorohwa neasina kutenderwa-leak spikes. Usati wakumbira kubvisirwa bhiri pasi perutsigiro rwe "Akaunti uye Kubhadharira", unofanirwa kutanga waratidza kuti kuvuza kwakavharwa nezana muzana: bvisa makiyi eIAM akafumurwa, kumisa zviitiko zvese zvehutsotsi uye Mapoka eAuto Scaling kumatunhu ese epasirese makumi matatu, gonesa Multi-Factor Authentication (`MFA`) pane yako midzi account, uye gadzira AWS Budgets yekuzivisa mutengo.

Sei achidaro git rm .env kusabvisa kiyi yangu yakavanzika kubva kuGitHub?¶

Git isingachinji vhezheni-control ledger: kana uchimhanya `git rm .env` uye kusundira kuzvipira kutsva, Git inongorekodha kuti faira racho harisipo mune nyowani snapshot (`HEAD`), uchichengeta chinyorwa chakazara che `.env` zvakachengetwa zvachose mukati mechibvumirano chekare (`the parent commit`) mune yako repository yekuzvipira nhoroondo. Kunyangwe ukanyora nhoroondo yako zvakare `git filter-repo` uye kumanikidza-kusundidzira, chero munhu anogona kuramba achiverenga chakavanzika kana iwe usina kukanzura kune wekupa console. Gara uchidzora uye kutenderedza kiyi yakavanzika mudhibhodhi remupi wako kutanga, wobva washandisa `git filter-repo` kukwesha tambo yakafa kubva munhoroondo yako yekuzvipira.

Mazano anoenderana¶

• Tsaona yekugadzira dhatabhesi inodonha, git simba-push, chakavanzika kuvuza, uye chiitiko triage
• Yekugadzira dhatabhesi yakadonha kana S3 bhaketi radzimwa pasina ichangoburwa backup
• Netsaona yatumirwa email payroll, mutengi PII, kana HIPAA spreadsheet kumugamuchiri asiriwo.
• Netsaona chidzitiro chikamu chechakavanzika chemuhoro pepa, password maneja, kana rondedzero yekumisa paZoom / Matimu
• Emergency kure kure kuchengetedza basa uye kuvanzika kwedata
• Nhamba dze emergency

Nzvimbo uye nhungamiro yepamutemo¶

• Amazon Web Services (AWS Security Incident Response Guide & AWS Knowledge Center: "What should I do if I notice unauthorized activity or exposed IAM access keys?"): AWSCompromisedKeyQuarantineV2 Policy Behaviour, Kusashanda kwechinguvana STS Session Tokens (RevokeOldSessions), uye Multi-Region Resource Auditing.
• ** GitHub Zvinyorwa (GitHub Secret Scanning, Push Protection, & "Removing sensitive data from a repository" using git-filter-repo):** Partner Auto-Revocation Chirongwa (Stripe, AWS, OpenAI, NPM), git-filter-repo Nhoroondo Kunyorazve, uye Kuchenesa Kusingasvikiki Yakavharirwa Commit SHAs.
• ** Stripe Inc.Stripe Developer Security Guide: API Key Rotation & Compromised Key Incident Triage):** Pakarepo sk_live_ Kupera Kwakakosha, Kuongorora /v1/events uye /v1/webhook_endpoints, uye Kurambidza Makiyi kuburikidza rk_live_ Zvikamu.
• NIST (Special Publication 800-61 Rev. 2 / Rev. 3: Computer Security Incident Handling Guide) & OWASP (Secrets Management Cheat Sheet): Credential Containment, Ephemeral OIDC Workload Identity Federation (replacing static CI/CD keys), uye Pre-Commit Chakavanzika Kuongorora.