When a credential is exposed, speed matters. The objective is not to prove that nobody saw it. The objective is to make the exposed value useless, determine whether it was abused, and prevent the same process failure from happening again.
Identify exactly what was exposed
Determine the credential type, affected system, privilege level, environment, and approximate exposure window. A production administrator token requires a different response from a low-privilege test credential.
Revoke or rotate first
Invalidate the exposed value as soon as practical. Change the password, revoke the API token, regenerate the key, invalidate recovery codes, or replace the certificate or private key as appropriate.
Consider active sessions
A password change may not terminate active browser sessions or refresh tokens. Review the platform's session controls and revoke sessions where appropriate.
Review activity
Check sign-in logs, API logs, administrative actions, network records, and application activity for the exposure period. Focus on activity the credential was authorized to perform.
Remove the exposed copies
Delete or redact the value from the accidental location after it is invalidated. Clean repository history, tickets, documents, or messages according to the system's capabilities and organizational policy.
Assess downstream secrets
If the compromised credential could retrieve other credentials, access a password vault, or administer identity systems, the response scope may need to expand.
Document the incident
Record the timeline, credential type, systems affected, rotation action, investigation findings, and corrective actions. Do not place the replacement credential in the incident record.
Fix the workflow
If people routinely paste credentials into chat or tickets, provide an approved alternative and update procedures. Human error is easier to reduce when the safer path is clear and convenient.