What problem does it solve? A leaked credential — committed to git, pasted in chat, or exposed in logs — is compromised from the moment of exposure, and ad-hoc responses (deleting the commit, delaying rotation) leave the breach unaudited and the secret live. This Skill provides a rotate-first incident playbook that contains the leak, determines whether it was exploited, and fixes the systemic gaps that allowed it. ## Core Features & Use Cases - Rotate-first playbook: Issues a new credential, cuts over consumers, then revokes the old one using two-key overlap to avoid self-inflicted outages. - Usage audit and blast-radius assessment: Pulls provider audit logs (CloudTrail, GitHub token audit, Stripe/Twilio dashboards) across the documented exposure window and maps what the credential could reach, including secondary credentials it could mint. - History purge and sibling scan: Rewrites git history with git filter-repo after the audit completes, then runs gitleaks or trufflehog to find companion secrets. - Use Case: GitHub secret scanning flags an AWS key pushed to a public repo 33 minutes ago. Follow the playbook to rotate the key, discover four unauthorized API calls in CloudTrail, escalate to a full incident, rotate a reachable database password, and ship push protection org-wide. ## Quick Start Respond to my leaked credential incident: an API key was committed to a public git repository, walk me through rotation, usage audit, and history cleanup.
