Secret scanning finds exposure, not erasure
A scanner telling you a key is in your code has told you it is exposed. It has not made it safe.
The instinct is to remove the line and consider it handled. The secret has already been in a place other people could read, possibly for years, and there is no way to establish who took a copy. The only complete response is to replace it. Finding it is the easy half; the rotation is the half that actually closes the exposure.
More on Passwords and secrets
- Password length beats decorative complexityAdd wheels, not squiggles
- Forced rotation can create predictable passwordsOnly one character moves
- Salts make identical passwords look differentOne grain each
- Every secret copy creates another secret to protectEvery copy needs its own guard
- Secrets in source control have a long memoryThe deletion is just another commit
- Environment variables are not secret vaultsA label on the outside of the bag