Secure › Module 9 › Lesson 3
Rotation Response
Revoke, rotate, audit — incident response when YOUR $REPO leaked a test or real key.
Visual · t17_rotation_response
Leak response = assume active until rotated. Original Cyberlium.
Opening
Deleting the file without rotating the key is closing the barn door after the horse logged in from Brazil.
When gitleaks or a human finds a committed secret in $REPO: (1) revoke/rotate immediately in provider console; (2) audit access logs if available; (3) remove secret from working tree; (4) plan history cleanup if needed with team; (5) document incident in private notes. Use disposable test keys in lab only. Never use rotation drills as excuse to test keys on production systems you do not own. Report employer leaks through proper channel — not public paste.
1. Immediate steps
Revoke token or roll API key — old value must fail fast.
Check billing and access logs for anomaly window since commit timestamp.
Command guide
Try these commands — Immediate steps
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Secret rotation — https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html CISA incident — https://www.cisa.gov/topics/cybersecurity-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
openssl rand -base64 32 | head -c 24; echo ' # new lab secret after rotation drill' grep -l leak_demo "$HOME/cyberlium-lab/t17-demo/"* 2>/dev/null && echo 'Remove demo secret file after rotation notes'
Primary tools to practice this lesson: openssl, grep. Reference sites: Secret rotation (https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html); CISA incident (https://www.cisa.gov/topics/cybersecurity-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Git cleanup
New commit removes secret; history rewrite needs coordination and force-push policy.
Prevention: pre-commit gitleaks beats painful history surgery.
3. Lab vs prod
Lab test keys still get rotation practice — treat drill seriously.
Prod keys in $REPO accident → escalate per org policy; course notes generic steps only.
4. What you ship: rotation runbook
Five-step rotation runbook + audit note + no public leak posting rule.
5. What you record before the next lesson
Rotation runbook path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Post found API key to Discord to 'warn' the owner publicly.
Right
Name rotation steps. Next: secrets lab.
Mission: rotation runbook draft
1) Write five rotation steps. 2) Note when history rewrite needed. 3) Write NEVER publish live secrets.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Order: rotate vs git filter?”
Knowledge Check
APPLY: First on leaked key:
Multiple choice
Knowledge Check
APPLY: True or False: Tweet stranger leaked keys to help.
True or False
Knowledge Check
APPLY: Pre-commit gitleaks:
Multiple choice