Credentials leak. They get committed to public repositories, pasted into support tickets, embedded in
mobile apps, logged by middleware, and left in a .env file on a laptop that gets sold. This is not a
hypothetical — cloud providers have had to build entire notification programs because customer keys
turn up publicly so often. Design for the leak rather than against it.
As a provider, that means: scope every credential to the minimum it needs, expire tokens by default, make rotation a one-click operation that does not require downtime, make revocation instant and obvious, show users when each credential was last used and from where, and alert on anomalous usage patterns. Never display a full secret again after issuance. Prefix your keys with a recognizable identifier so scanners — including GitHub’s — can detect them in the wild.
As a consumer: never commit secrets, use a secrets manager rather than environment files, scan your own repositories and history, rotate on any suspicion, and give each integration its own credential so you can revoke one without breaking everything.
The framing that keeps this honest is that a key is an accounting mechanism, not a lock. Its job is to tell you who is calling. The moment it stops telling the truth, everything downstream — your rate limits, your billing, your audit trail — is lying to you too.
