Secret rotation

Skill Hayatelin/devsecops-skills/skills/secret-rotation

A security skills pack for Claude Code, Cursor, Codex and Gemini CLI: secrets pre-flight, dependency audit, secret rotation, STRIDE threat modeling, secure code review, Dockerfile hardening and env hygiene.

Install

npx -y skills add Hayatelin/devsecops-skills --skill secret-rotation

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Calm, correct incident response when a secret is leaked or committed. Trigger when the user says "I committed an API key", "a token leaked", "rotate this secret", "remove a key from git history", or when a scan finds a credential in source or history.

SKILL.md

3.0 KB, as published. Nobody here has run it

When to use

A secret (API key, token, password, private key, connection string) was committed, pushed, pasted in a PR, or exposed in logs.
A scanner (secscan, GitHub secret scanning, gitleaks) flagged a live credential.
A laptop, CI runner, or third-party service was compromised.

Process — rotate FIRST, scrub second

Stay calm and assume compromise. If a secret left your machine, treat it as already in someone's hands. The clock matters more than tidiness.
Rotate / revoke at the provider FIRST. Generate a new credential and invalidate the old one in the provider's console (AWS IAM, Stripe, GitHub, etc.). Deleting the line in code does NOTHING — the old value still works until revoked.
Deploy the new secret to env vars / your secrets manager and verify the app works on the rotated value.
Then remove the secret from the working tree and from git history.
Audit for misuse — check provider access logs / billing for unexpected activity during the exposure window.
Prevent recurrence — add a pre-commit secret scan and move config to a manager (see "How to fix").

Checklist

New credential issued and confirmed working in the target environment.
Old credential REVOKED at the provider (not just removed from code).
Secret pulled from source and .gitignore/secrets manager updated.
Secret purged from git history (commands below) and force-pushed.
Collaborators told to re-clone or hard-reset (rewriting history breaks their local copies).
Provider access/audit logs reviewed for abuse during exposure.
Pre-commit secret scanning enabled to stop a repeat.

How to fix

Purge from history (after rotating). Preferred: git filter-repo --invert-paths --path path/to/file or for a value: git filter-repo --replace-text expressions.txt. Alternative: BFG — bfg --replace-text passwords.txt. Then git push --force to all remotes. Note: GitHub caches; the old commit may still be reachable via its SHA, so rotation is what actually protects you.
Store secrets properly — environment variables, AWS/GCP/Vault secrets manager, GitHub Actions encrypted secrets, or a .env that is git-ignored. Never in source, never in client-side bundles.
Prevent — install gitleaks/secscan as a pre-commit hook and enable provider-side secret scanning + push protection.

Report back

State plainly: what leaked, where, the exposure window, and — most important — that the credential was REVOKED and ROTATED (not just deleted). Then list history-purge status, log-review findings, and the prevention control you added. If rotation is still pending, say so loudly: until the old value is revoked, the incident is open.