The Secret Leak Field Manual

Where keys escape, what each one exposes, and exactly what to do about it

KeyDrift · First edition · August 2026

---

Who this book is for

You build or ship web applications. You hold API keys — payments, cloud, databases, language models, source control, email. You want to know where those keys actually end up, what a stranger can do with each kind, and what to do in the first hour, the first day, and every day after a leak.

This is a field manual, not an essay. Every chapter opens with the question it answers, contains at least one table, checklist, or worked walkthrough, and closes with a short Do this now list. Those lists accumulate into Appendix A, which is the whole book compressed into one page you can act from.

What it covers, and what it does not

The center of gravity is the web application: its source, its build, its pipeline, and the browser bundles it ships. Mobile and native binaries are covered as escape surfaces because keys land there too; scanning deployed mobile binaries is outside the scope of the tooling this book references, and Chapter 1 says so plainly.

Three commitments hold throughout:

• No working secrets. Every credential shown in this book is synthetic and carries a FAKE marker inside it. The approved examples live in Appendix B.
• Capability, not exploitation. The book describes what possession of a key makes possible, so you can judge blast radius and prioritize rotation. It never walks through abusing someone else's key.
• Cited facts only. Provider behavior is cited to official documentation, and named incidents are cited to public primary accounts. Where the book has no citation, it says so or stays general.

How incidents are handled here

Two incidents are referenced by name because both companies published thorough primary accounts, and both shaped the runbooks in this book: Codecov's 2021 Bash Uploader compromise (Codecov's security update) and CircleCI's January 2023 incident, in which customer environment variables were taken from a CI platform (CircleCI's incident report). Other situations are described generically on purpose.

Conventions

• Runbooks are numbered steps with decision points ("if X → step N"). Read them once now; execute them under pressure later.
• Severity words (critical, high, medium) follow the rubric defined in Chapter 3.
• Console paths are written as they appear in each provider's product at publication time. Providers change menus; the cited documentation is the authority if a path has moved.
• American spelling throughout.

Independence note

Stripe, Amazon Web Services, Google, Firebase, Supabase, OpenAI, Anthropic, GitHub, Twilio SendGrid, Resend, Slack, Mapbox, MongoDB, PostgreSQL, Clerk, and others are referenced descriptively to document their published key systems. KeyDrift is an independent product and is not affiliated with, endorsed by, or sponsored by any of them. This book cites their documentation because their documentation is authoritative for their products.

One offer

This book makes exactly one request of you, at the very end: point a scanner at something you own. Everything before that point works without it.