Appendix A · The master "do this now" checklist

The Secret Leak Field Manual · 4 min read

Every chapter's closing list, compiled and grouped. Work top to bottom for a standing program; jump to the incident section when something has already leaked. Chapter numbers in parentheses point back to context.

Know your exposure

[ ] Keep the eight-surface map (source, build logs, CI artifacts, bundles, error trackers, mobile binaries, collaboration surfaces, AI loops) next to the key inventory — every response starts by naming surfaces involved. (Ch. 1)
[ ] Check one production app for publicly fetchable source maps by appending .map to a bundle URL. (Ch. 1)
[ ] Read the CircleCI January 2023 incident report end to end once. (Ch. 1)
[ ] Ask honestly whether any teammate has pasted a .env file into chat, tickets, or an AI prompt. (Ch. 1)
[ ] Inventory every credential against the six families (payments, cloud, database/backend, LLM, source control, email/SMS/messaging); mark each full-scope or scoped. (Ch. 2)
[ ] Confirm no Mapbox secret token and no Supabase service_role/sb_secret_ value exists in browser-facing code. (Ch. 2)
[ ] Open each provider's cited documentation once before you need it under pressure. (Ch. 2)

Stand up assessment

[ ] Save the blast-radius worksheet as a reusable template. (Ch. 3)
[ ] Write the rule for who may rate an incident critical. (Ch. 3)
[ ] Locate and bookmark per-key request-log views for every provider in use. (Ch. 3, Ch. 5)
[ ] Run one timed worksheet drill on any inventory key, masked values only. (Ch. 3)

Prepare the first hour

[ ] Place the runbook where responders can reach it without a laptop. (Ch. 4)
[ ] Pre-decide which conditions trigger immediate revocation over orderly rotation, and who can call it alone. (Ch. 4)
[ ] Verify you can rebuild and redeploy every public-facing app on short notice. (Ch. 4)
[ ] Learn your CDN's global purge behavior once, in calm conditions. (Ch. 4)
[ ] Adopt masking (first 8 + last 4, never more than half) in every tool used to discuss findings. (Ch. 4)

Prepare the first day

[ ] Bookmark usage/activity views per provider class (payments, cloud, database, LLM, source control, email/SMS). (Ch. 5)
[ ] Set log retention to cover realistic audit windows. (Ch. 5)
[ ] Draft the empty incident-record skeleton (Appendix C) now. (Ch. 5)
[ ] Name the disclosure decision owner by title; add payment processors to the notification list automatically for payment-class exposures. (Ch. 5)

Rotation readiness

[ ] Complete one harmless end-to-end rotation using Appendix D as the log. (Ch. 6)
[ ] Migrate at least one unrestricted payment or LLM key to a scoped equivalent with spend limits. (Ch. 6)
[ ] If running Supabase legacy JWT keys, begin migration to new-format keys ahead of the end-of-2026 deprecation. (Ch. 6)
[ ] Configure access policies or IP allowlists on highest-severity credentials where supported. (Ch. 6)

Layer detection

[ ] Map current checks onto the five stages (pre-commit, CI gate, pre-deploy artifact, post-deploy, scheduled); name gaps honestly. (Ch. 7)
[ ] Close the baseline gap first: repo scanning without post-deploy scanning is half coverage. (Ch. 7)
[ ] Verify scanner exit codes distinguish clean / findings / could-not-scan before wiring CI gates. (Ch. 7)
[ ] Adopt an allowlist policy requiring owner + expiry, reviewed quarterly. (Ch. 7)
[ ] Schedule one external check of production that depends on no pipeline component. (Ch. 7)

Arrange the AI-era workflow

[ ] Inventory credentials reachable by AI tooling (editor settings, agent configs, MCP servers, shell profiles). (Ch. 8)
[ ] Replace any production key reachable from development sessions with a scoped, capped equivalent. (Ch. 8)
[ ] Add credential markers (eyJ, sk_, sk-, AKIA, ASIA, BEGIN PRIVATE KEY, postgres://, mongodb+srv) to review checklists and post-build searches. (Ch. 8)
[ ] Write the one-line policy on secrets in prompts, with a concrete sanctioned alternative. (Ch. 8)
[ ] Enable change-based alerts for deployed apps. (Ch. 8)

Run the program

[ ] Score all six key families against the maturity stages; write it down. (Ch. 9)
[ ] Advance the lowest-scoring family one stage, not ten. (Ch. 9)
[ ] Start OIDC federation for CI if it holds long-lived cloud keys. (Ch. 9)
[ ] Adopt the new-credential rule: scope first, cap spend, set expiry, log before first use. (Ch. 9)

Drill

[ ] Calendar Drill C (LLM key in public repo) first; assign a permanent facilitator. (Ch. 10)
[ ] Feed "what surprised us" notes into the record template so drills improve response. (Ch. 10)
[ ] Verify every responder holds working console permissions — drills fail on access, not knowledge. (Ch. 10)

During an incident

[ ] First hour: record → classify → containment path → stage replacement → rotate → redeploy + purge → sweep copies → verify dead → watch the gap → rescan → update record. (Ch. 4)
[ ] First day: usage audit across full exposure window per provider class → enumerate every environment holding copies → disclosure inputs to counsel/processor → written record complete. (Ch. 5)