5 · The first day

The Secret Leak Field Manual · 4 min read

Question this chapter answers: Once the key is dead, what did it do while it was alive?

Containment answers "can it still hurt?" — the first day answers "did it already?" Three workstreams fill the day: audit usage across every provider the credential touched, assess the true scope of exposure honestly, and write everything down while memory is exact. The fourth topic — disclosure — depends on the first three.

Usage-log audit by provider class

Every major provider records per-credential activity. The audit asks one question over the full exposure window (from first-possible exposure to revocation, not from discovery): is every request attributable to your code?

Class	Where usage appears	What to look for
Payments	Per-key request logs in the dashboard; event deliveries per webhook endpoint	Endpoints or methods outside the integration's normal set; unfamiliar source networks; refunds or payouts you did not make
Cloud	CloudTrail event history filtered by access key ID for AWS; audit logs per service for GCP	Calls from unexpected regions or user agents; role assumptions; resource listing followed by reads — reconnaissance has a shape
Database / BaaS	Database connection logs; provider dashboards' API logs	Connections from unknown IPs; row-level operations inconsistent with app behavior
LLMs	Per-project usage and activity views in the provider console	Model calls at hours your app does not run; token volumes inconsistent with traffic; models your product does not use
Source control	Organization and repository security/audit logs	API activity attributed to the token's identity that no human recognizes
Email / SMS / messaging	Sending activity and suppression lists (SendGrid's activity view; Resend logs); Slack audit logs for token use	Sends to addresses outside your users; template or content changes; spam waves wearing your domain

CircleCI's incident report is the model for how seriously to take the window: after customer environment variables were taken in their January 2023 incident, they told customers to investigate for unusual activity from the date of compromise through the date they completed rotation (CircleCI incident report). The window is bounded by exposure, not by when you noticed.

Scope of exposure, honestly assessed

Usage logs tell you what the key did. Scope tells you where copies may live. Enumerate every environment where the value existed:

Deployed artifacts: production bundle, preview deployments (they build with real environment values attached), archived builds, published source maps.
Pipeline configuration: CI variables and contexts, deploy scripts, infrastructure-as-code state files.
People: local .env files on every laptop that touched the project, password-manager entries, personal dotfiles.
Third parties: vendors who received keys for integrations, agency contractors, AI assistant sessions where context included secrets.

Each location gets a disposition: cleaned, scheduled, or accepted-with-reason. "Accepted" is legitimate for genuinely dead copies (an expired preview build) as long as someone wrote the reason down.

Disclosure decisions

Disclosure is a judgment with inputs, not a reflex. The inputs this book can supply:

What the credential could reach (Chapter 3 worksheet) versus what usage shows it reached.
Whether personal data was reachable, which changes the legal analysis entirely — involve counsel before contacting customers, and let counsel map regulatory timelines to your facts.
Payment-class specifics: payment processors maintain their own compromise procedures; if a live payment key was exposed, notify the processor early regardless of whether usage looks clean. Card-network rules run on their own clocks.
Counterparty obligations: when exposure came through a vendor platform (a CI provider, a hosting platform), their incident communications define what they saw and what they already asked customers to rotate.

What disclosure is not: an admission ritual performed before containment. Fix first, disclose on facts.

The written record

By end of day, the incident file contains:

Timeline: discovery, classification, containment, rotation, verification — each timestamped.
Evidence locations: log exports, request-log screenshots, scanner reports, commit references.
Actions ledger: what changed, who changed it, when.
Open items: copies not yet swept, audits still running.
Root cause, stated structurally — "the value wore a public env prefix" rather than "someone made a typo."

The record exists because memory decays faster than consequences. It is also the artifact that turns this incident into training data: Chapter 9's maturity staging and Chapter 10's drills are built from exactly these documents.

Do this now

[ ] Bookmark the per-key usage view for every provider in your inventory (the Chapter 5 table names them).
[ ] Set log retention deliberately; an audit window longer than your retention is an audit you cannot run.
[ ] Draft the skeleton of Appendix C now — an empty record costs nothing during calm hours.
[ ] Decide who owns disclosure decisions (title, not name) and note that payment-class incidents add the processor to the notification list automatically.