| id | triage-suspected-secret-exposure |
| name | Triage Suspected Secret Exposure |
| description | Contain and respond to a suspected credential/secret exposure without increasing blast radius. |
| tags | ["security","incident","secrets","triage"] |
| maturity | draft |
| inputs | {"secret_type":"string","exposure_location":"string","first_seen_time":"string?"} |
| outputs | ["containment_actions","rotation_plan","verification_steps"] |
| tools_allowed | ["vcs.read","logs.query","secrets.read"] |
| safety | {"default_mode":"read_only","forbidden":["secrets.write","vcs.rewrite_history"],"requires_confirmation_for":["secrets.write","vcs.rewrite_history"]} |
When to use
Use when a secret may have been exposed (committed to VCS, printed in logs, pasted to a ticket).
Preconditions
- You have a security contact path and access to rotate the secret.
Procedure
- Treat as real until proven otherwise; minimize sharing of the secret.
- Identify what secret it is, where it was exposed, and potential access scope.
- Contain: revoke/disable the credential if supported.
- Rotate: issue a new secret, deploy it, then remove the old one.
- Remove exposure sources (redact logs, remove from docs, invalidate caches).
- Audit usage for suspicious activity.
Decision points
- Public exposure (public repo, public paste): rotate immediately.
- High-privilege secret: prioritize containment and audit.
- Cannot rotate quickly: restrict permissions and add compensating controls.
Verification
- Old credential is invalid and cannot authenticate.
- New credential works in production.
- No further leak sources remain.
Rollback / undo
- If rotation breaks service, restore from a secure rollback mechanism while keeping the old credential revoked if possible.
Escalation
- Escalate to security team for incident handling and external notifications.
- Escalate to compliance/legal if required.
Examples
Do not paste the secret into issues, PRs, or chat logs.
