What to Do If You Committed an API Key to GitHub

Treat it as a confirmed breach from the moment you know. Automated bots scan GitHub commit history continuously — not just the latest files, but every commit ever pushed. A key that touched a public repo even briefly can be found within seconds. A private repo is less immediately dangerous but not safe: collaborators have access, the repo can become public, and your own account could be compromised.

The consequences depend on the key. A leaked OpenAI key can run up hundreds of dollars in API charges before you notice. A leaked Stripe secret key can create test charges or access customer data. A leaked database URL gives read and write access to your data. The sooner you rotate, the smaller the damage window.

Do not wait to assess the situation before rotating. Rotate immediately, then investigate. Key rotation is fast and reversible; damage from a misused key may not be.

Open the provider's dashboard and find the API keys section. Revoke or delete the compromised key, then generate a new one. Different providers use different terminology — look for 'Revoke', 'Delete', 'Roll', or 'Regenerate'. The goal is to make the old key permanently invalid.

Do this for every key in the commit, not just the one you noticed. If your .env file was committed, assume every key in it is compromised.

After generating new keys, update your local .env file with the new values. Do not commit .env. You will add the new production values to your hosting platform in a later step.

• OpenAI: platform.openai.com → API keys → Delete key → Create new
• Stripe: dashboard.stripe.com → Developers → API keys → Roll key
• Supabase: project settings → API → Regenerate service role key
• GitHub personal access tokens: github.com → Settings → Developer settings → Personal access tokens
• Anthropic: console.anthropic.com → API Keys → Delete key → Create new

Git stores every version of every file ever committed. Deleting .env and committing that deletion removes the file from the latest snapshot, but the full key value remains readable in any prior commit.

Anyone can run git log and git show to access the full content of any historical commit. GitHub's web interface also allows browsing commit history. The key value is not gone — it is just not visible in the current file tree.

This is why rotation comes before history cleanup. Rotation makes the compromised key worthless immediately. History cleanup is a secondary step that reduces long-term risk, but it is slower and more complex.

After rotating, search your entire project for the old key value and any hardcoded key patterns. Remove them from source files. Replace string literals with environment variable references: process.env.OPENAI_API_KEY in Node.js and Next.js, os.environ['OPENAI_API_KEY'] in Python.

If the key was in a .env file that was committed, update .env with the new (rotated) key value. The new value has never been committed, so it is safe locally.

Also check README files, documentation, and any notes files. Developers sometimes paste real keys into documentation as examples. Replace any real values with placeholder strings.

Open .gitignore in your project root. Add .env on its own line if it is not already there. Save the file.

Then check whether .env is currently tracked by Git. Run git ls-files .env — if it returns the filename, it is tracked and needs to be explicitly untracked. Run git rm --cached .env to stop tracking it without deleting your local copy. Commit this change: git commit -m 'stop tracking .env'.

Verify with git status that .env no longer appears in the list of staged or unstaged changes. From this point forward, Git will ignore .env completely.

Create .env.example in your project root. List every variable your app reads with descriptive placeholder values: OPENAI_API_KEY=your_openai_api_key_here. This file is safe to commit — it contains no real secrets.

Commit .env.example to GitHub. It serves as documentation for what the project needs and shows reviewers that you have thought carefully about secret management.

If .env.example already exists, review it to confirm all current variables are listed and no real values snuck in.

Rotation makes the old key useless, but cleaning history reduces the risk of future confusion and removes the key from GitHub's searchable commit history. GitHub provides official guidance on removing sensitive data from repositories.

The standard tools are git filter-branch (older, built-in) or the BFG Repo Cleaner (faster and easier for most cases). Both rewrite history, which changes commit hashes and requires a force push — coordinate with any collaborators before doing this.

For small solo projects where rotation has already happened, history cleanup is good hygiene but not urgent. For team projects or if the key is for a high-value service, prioritize cleaning history promptly.

Your hosting platform needs the new (rotated) key value. Log into your hosting dashboard and update the environment variable with the new key. On Vercel: Project → Settings → Environment Variables. On Railway: your service → Variables tab. On Render: your service → Environment.

After updating, trigger a new deployment so the running app picks up the new value. Test the live URL to confirm the API calls still work. If anything breaks, the old key is already revoked — check that the new key value was entered correctly.

Review all environments: if you have staging and production, update both. If you use CI/CD pipelines with stored secrets, update those too.

After rotating, check the provider's usage dashboard. Look for requests during the window when the key was exposed — from the time of the first commit containing it until the time you rotated. Unexpected request volumes or requests from unfamiliar IP addresses are signs of misuse.

Most providers show usage by API key. Some provide logs with timestamps and source IPs. Note the total usage and whether it matches what you expected for that period.

If you find evidence of misuse, contact the provider's support team. Many providers have processes for investigating and reversing fraudulent charges when you report promptly. Document the timeline of discovery and rotation.