A generic incident response framework (detection, containment, eradication, recovery, lessons learned) applies well to leaked credentials specifically — but each phase has concrete, credential-specific actions worth having decided in advance.
Detection
The best detection is automated: secret scanning across your codebase, CI logs, and git history, ideally catching exposure within minutes rather than relying on someone noticing manually. Also plan for external detection — a security researcher, a customer, or the credential provider itself notifying you of unusual activity tied to a key.
Containment
The immediate priority is stopping further use, not full investigation. Deactivate or revoke the credential first — investigation can happen with the credential already contained rather than delaying containment to investigate first. For credentials with a broad blast radius, consider whether related credentials or systems need immediate attention too, not just the one confirmed exposed.
Eradication
This is where you address the root cause of the exposure, not just the immediate credential. If it leaked via a git commit, the value likely still exists in git history even after rotation — that needs separate remediation (revoke, then clean history). If it leaked via a misconfigured CI log, fix the logging configuration itself.
Recovery
Confirm every dependent service is functioning correctly on the replacement credential before considering the incident resolved. Rotating a credential and immediately moving on without verification risks discovering a broken integration hours later, disconnected from the original incident timeline.
Post-incident review
This step is the one most commonly skipped once the immediate fire is out. Ask specifically:
- How was the credential exposed? (committed to git, logged in plaintext, shared over an insecure channel?)
- What control would have caught this before exposure — not just after?
- Is this a one-off mistake, or a pattern worth fixing structurally (e.g. a missing pre-commit hook, a logging configuration used across multiple services)?
Having the plan written down before you need it
The value of documenting this in advance isn't the document itself — it's that the first 15 minutes of an actual incident are spent executing a known plan, not debating what the first step should be while the exposure is still live.