18 lines
991 B
Markdown
18 lines
991 B
Markdown
|
# Playbook: Credential Leak
|
||
|
|
|
||
|
|
**Triggers:** token in Git/logs/chat, stolen laptop, exposed `.env`, compromised CI secret.
|
||
|
|
|
||
|
|
## Steps
|
||
|
|
|
||
|
|
1. **Identify scope** — which credential, which systems, exposure window.
|
||
|
|
2. **Revoke immediately** — invalidate leaked token/password before cleanup discussion.
|
||
|
|
3. **Rotate downstream** — every system that trusted the credential (OpenBao, Stripe, Gitea/Forgejo, backup drop, OpenRouter, webhooks).
|
||
|
|
4. **Scan for misuse** — auth logs, Stripe dashboard, API usage anomalies, unexpected git pushes.
|
||
|
|
5. **Remove secret from exposure** — git history scrub if committed; rotate not revert.
|
||
|
|
6. **Verify separation** — confirm backup credentials still isolated (`BackupPolicy.md` CS-1).
|
||
|
|
7. **Re-deploy** — refresh Kubernetes secrets via External Secrets / OpenBao.
|
||
|
|
8. **Document** — incident note; no secret values in State Hub or evidence files.
|
||
|
|
|
||
|
|
## References
|
||
|
|
|
||
|
|
`AssetRegister.yaml` T0 entries · `PanicSheet.md` §4 · ops-warden credential routing
|