Leaked Secret in CI Logs: Rotate, Audit, Prevent

A secret in a build log is compromised the moment it appears — you can't know who's seen it, whether a bot scraped it, or whether a third-party logging integration cached it. The instinct to delete the log first is wrong; the secret is already out, and rotation is the only action that actually mitigates risk.

The correct priority order

Step 1 — rotate within 5 minutes

• For AWS: deactivate the access key with aws iam update-access-key --status Inactive, then create a new one
• For GitHub PATs, Vault tokens, etc.: revoke and reissue
• Deactivate before deleting — deactivation is reversible if you discover an internal system was using the key legitimately

Step 2 — audit usage within 30 minutes

• Query CloudTrail for the leaked key ID; look at every API call made with it
• Check GuardDuty findings for anomalous behavior
• Watch for telltales of abuse: calls from unfamiliar IPs, calls from unexpected regions, large data egress, IAM modifications creating new keys (a classic post-compromise pattern)

Step 3 — contain blast radius

• Review the IAM policy attached to the leaked credential
• If admin (*:*), escalate to security — the blast radius is the whole account
• If scoped, verify nothing in that scope was modified

Step 4 — purge logs (after rotation, not before)

• Delete the workflow run in GitHub Actions, erase the job in GitLab CI, delete the build in Jenkins
• Be honest about limits: downstream log forwarders, Slack notifications, third-party scrapers may already have copies; deletion is housekeeping, not mitigation

Step 5 — blameless postmortem within a week

• Timeline, root cause, contributing factors, action items with owners
• Structural fixes: migrate to OIDC, enable secret masking, add pre-commit gitleaks, tighten IAM policies

The structural answer is OIDC

• Long-lived secrets in CI are inherently risky — they leak in logs, sit in repo configs, sprawl across systems
• OIDC federation issues short-lived tokens per workflow run, scoped via repo and branch claims; no long-lived credentials to leak
• GitHub Actions to AWS via OIDC, GCP Workload Identity Federation, Azure federated identity — every team should be on this migration path

Defense in depth on secret scanning

• Pre-commit hooks with gitleaks locally; pre-push hooks; CI as a required check; platform-level GitHub Push Protection on the org
• Each layer catches what others miss; relying on one is fragile

Cultural piece

• Blameless reporting — the engineer who immediately tells security gets thanks; cover-ups create legal and trust issues if discovered later
• The discipline: rotation is the security control; deletion is hygiene; postmortem produces the structural fix that prevents the next leak