# Playbook: Credential Leak

**Triggers:** token in Git/logs/chat, stolen laptop, exposed `.env`, compromised CI secret.

## Steps

1. **Identify scope** — which credential, which systems, exposure window.
2. **Revoke immediately** — invalidate leaked token/password before cleanup discussion.
3. **Rotate downstream** — every system that trusted the credential (OpenBao, Stripe, Gitea/Forgejo, backup drop, OpenRouter, webhooks).
4. **Scan for misuse** — auth logs, Stripe dashboard, API usage anomalies, unexpected git pushes.
5. **Remove secret from exposure** — git history scrub if committed; rotate not revert.
6. **Verify separation** — confirm backup credentials still isolated (`BackupPolicy.md` CS-1).
7. **Re-deploy** — refresh Kubernetes secrets via External Secrets / OpenBao.
8. **Document** — incident note; no secret values in State Hub or evidence files.

## References

`AssetRegister.yaml` T0 entries · `PanicSheet.md` §4 · ops-warden credential routing