Part 3: Response (When Things Go Wrong)

3.1 Secret Exposed

First 15 minutes (stop the bleeding):

1. Revoke immediately

   # AWS
   aws iam delete-access-key --access-key-id AKIA... --user-name <user>
   
   # GitHub
   # Settings → Developer settings → Personal access tokens → Revoke
   
   # Stripe
   # Dashboard → Developers → API keys → Roll key

2. Confirm exposure scope

   # Check if pushed to remote
   git log --oneline origin/main..HEAD
   
   # Search for the secret pattern
   git log -p | grep -E "(AKIA|sk_live_|ghp_|xoxb-)"
   
   # Full repo scan
   gitleaks detect --source . --report-format json > exposure-report.json

First hour (assess damage):

3. Audit git history

   # If pushed, you may need to rewrite history