🚀 -> Project on GitHub <-

Emergency Plan for Secret Leaks

📚 Navigation: 🏠 Home 📖 Docs 🔒 Security 📋 Release ✅ Pre-Release Check

This guide describes immediate actions for accidental commits of secrets or API keys.

🚨 Immediate Actions (within 1 hour)

1. Identify Secret Type

Determine what was leaked:

2. Revoke Affected Secrets IMMEDIATELY

API Keys:

# Brave Search API
# https://brave.com/search/api → Revoke

# Serper API
# https://serper.dev/dashboard → Delete

# GitHub Tokens
# https://github.com/settings/tokens → Delete Token

Passwords:

# Change ALL affected passwords immediately
# End ALL sessions

3. Clean Git History

⚠️ Important: Permanently changes Git history!

git clone --mirror https://github.com/arn-c0de/Crawllama.git crawllama-backup
bfg --replace-text passwords.txt crawllama.git
cd crawllama.git
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force

Option B: git-filter-repo

pip install git-filter-repo
echo "BRAVE_API_KEY=abc123xyz" > secrets.txt
git filter-repo --replace-text secrets.txt
git push --force

Option C: Manual (small repos)

git reset --hard HEAD~1
git push --force
# or interactive rebase
git rebase -i HEAD~10
# "drop" affected commits
git push --force

4. Generate New Secrets

# Generate new API keys
echo "BRAVE_API_KEY=new_key_here" >> .env
echo "SERPER_API_KEY=new_key_here" >> .env

# Ensure .env is ignored
echo ".env" >> .gitignore
git add .gitignore
git commit -m "chore: ensure .env is in .gitignore"

5. Inform All Collaborators

Create GitHub Security Advisory or private issue. Example notification:

🚨 CRITICAL: Secret Leak

A secret was accidentally committed.

**Affected:**  
- API Key: Brave Search API  
- Commit: abc123  
- Exposed: 2025-01-25 10:30 UTC

**Actions Taken:**  
✅ Secret revoked  
✅ Git history cleaned  
✅ New secret generated  

**Required Actions:**  
- Pull latest changes  
- Update .env with new keys  
- Verify no local copies of old keys

📋 Prevention

Pre-Commit Hooks

pip install pre-commit
cat > .pre-commit-config.yaml << EOF
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
      - id: detect-private-key
      - id: check-added-large-files
        args: ['--maxkb=1000']
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
EOF
pre-commit install
detect-secrets scan > .secrets.baseline

Maintain .gitignore

cat >> .gitignore << EOF
.env
*.key
*.pem
*.p12
*.pfx
secrets/
credentials/
*.backup
*.bak
*~
logs/*.log
EOF

Secret Scanner in CI/CD

# .github/workflows/secret-scan.yml
name: Secret Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: $

Maintain .env.example

cat > .env.example << EOF
BRAVE_API_KEY=your_brave_api_key_here
SERPER_API_KEY=your_serper_api_key_here
HTTP_PROXY=
HTTPS_PROXY=
DEBUG=false
EOF

🔍 Detect Secret Leaks

GitHub Secret Scanning

git log -S "BRAVE_API_KEY" --all
grep -r "password" .
grep -r "BEGIN.*PRIVATE KEY" .

Gitleaks (local)

gitleaks detect --source . --verbose
gitleaks detect --source . --report-path gitleaks-report.json

📞 Incident Response Team

Role Responsibility Contact
Security Lead Coordination crawllama.support@protonmail.com
DevOps History cleanup crawllama.support@protonmail.com
API Owner Key rotation Service provider

Contact immediately for leaks: 📧 crawllama.support@protonmail.com

📊 Post-Incident Review

1. Incident Report

# Incident Report: Secret Leak
**Date:** 2025-01-25
**Severity:** HIGH
**Status:** RESOLVED

## Summary
API Key accidentally committed.

## Timeline
10:30 - Commit with secret pushed  
10:32 - Leak detected  
10:35 - Secret revoked  
10:45 - Git history cleaned  
11:00 - New secret deployed  
11:15 - All systems operational

## Root Cause
.env not checked in .gitignore

## Actions Taken
✅ Secret revoked  
✅ Git history cleaned  
✅ New secret generated  
✅ Team notified  
✅ Pre-commit hooks installed

## Prevention
- Pre-commit hooks mandatory
- Developer training
- .gitignore review

2. Lessons Learned

3. Prevention Measures

🔗 Useful Tools

Tool Purpose Link
BFG Repo-Cleaner Git history cleanup GitHub
git-filter-repo Advanced history rewrite GitHub
Gitleaks Secret detection GitHub
detect-secrets Pre-commit hook GitHub
truffleHog Secret scanner GitHub

📚 Further Resources

For active leaks: Report Security Advisory