Prompt: full checklist after a key leaks
Rotating the key is step one of five. The other four are where people stop too early.
Most people rotate the key and consider it handled. That closes the front door while leaving the window open: the secret is still in git history, and if it was abused, the attacker may already have created their own access.
Copy this into Cursor, Claude Code, Lovable or your builder
A credential of mine leaked. Walk me through closing it out completely. 1. Confirm the leaked secret is revoked at the provider, not merely replaced. Tell me exactly where to click for this provider. 2. Search this project for every other hardcoded credential, so I am not repeating this next week. Report file, line, and whether that code runs in the browser. 3. Check git history for the secret, not just current files. If it is in history, tell me plainly that rotating is mandatory because the value remains readable in the repository forever. 4. Look for signs the key was used: unexpected resources, new users or accounts, unfamiliar API activity. Tell me exactly which log or billing page to open for this provider. 5. Check for persistence — a second credential, user or token created by whoever had the key. Rotating the original does nothing if they made their own. 6. Put the replacement in a server-only environment variable and add a check so this class of secret cannot be committed again. Give me a numbered checklist with what I still need to do by hand.
What your AI should do with it
- Revocation confirmed, not just replacement.
- Git history checked explicitly.
- A persistence check — the step almost everyone skips.
How to check it worked
Confirm the old key is dead
- 1Try to use the old key against the provider's API.
- 2It must fail with an authentication error.
- 3If it still works, it was replaced but not revoked — go back and revoke it.
This is one check out of 40+
Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.
Check my site — free