Before you do anything else — even before you finish reading this — go revoke the exposed key. Don't wait until you understand the full scope. Don't wait to see if it was actually used. Assume it was found. Assume it's being used. Revoke it.
With the key revoked, check whether it was already used. Look at the logs for the service the key belonged to. You're looking for requests you didn't make — especially at unusual times or from unusual IPs.
If you see unauthorized usage: note the timestamps, IPs, and actions taken. You'll need this for any incident report or dispute. Screenshot everything now.
Revoking the key doesn't remove it from your git history. If your repo is public, bots have already indexed it — but remove it anyway. If it's private, remove it before anyone else gains access.
Important: Force-pushing rewrites history. Everyone with a clone needs to re-clone after this. Tell your team.
Before you write another line of code, put the guardrails in place. Add a pre-commit hook that catches secrets before they hit git.
Pre-commit hooks prevent the next accidental commit. But they don't protect the key once your app is running. That's a different problem — see below.
If there was unauthorized usage — especially involving customer data, payments, or internal systems — you may have notification obligations depending on your jurisdiction and any customer contracts.
Catch secrets before they're committed. detect-secrets, gitleaks, and trufflehog all work well. Stops the most common cause of leaks.
Doesn't help once the app is running. The key still exists as plaintext in your environment.
Partial — prevents commitsEncrypts keys at rest. Centralized access control. Audit logging. A real improvement over .env files.
Once your app retrieves the key, it becomes a plaintext string in memory. That's still vulnerable.
Partial — protects at restRegular rotation limits the window of exposure if a key is compromised. Combine with automatic rotation tooling.
The average enterprise rotates every 180 days. Breaches take 277 days to detect. The math still doesn't work.
Partial — reduces windowSplits the key before storage. A proxy reconstructs it only for the API call — milliseconds — then zeros it from memory. The full key never exists in your app, environment, or config.
A compromised dependency, a pushed .env, a supply chain attack — none of them can steal what doesn't exist.
Complete — protects in useProtect your API keys at the moment they're used — not just at rest.
Free to start. 15 minutes. Works alongside what you already have.
// npm install @vaultproof/sdk · pip install vaultproof