api key committed to public repo: takedown failed

TL;DR

Once a key is in a public repo, assume it is compromised: scrapers copy public commits within minutes. Revoke and rotate the key immediately, then pursue removal of the content as hygiene, not as containment.

Error

api key committed to public repo: takedown failed

Steps

1. Revoke the exposed key at the provider now. Expected: the key is dead regardless of who copied it.
2. Issue a replacement and update all consumers. Expected: services run on the new key.
3. Remove the key from the repo history (rewrite and force-push). Expected: the value no longer in the codebase.
4. Request takedown or cache purge from the host for the exposed content. Expected: best-effort removal; treat failure as expected.
5. Search for forks and mirrors that copied the commit; notify or accept the exposure. Expected: realistic containment assessment.

When to use

• API keys exposed in public repos.
• Any public leak where takedown is uncertain.

When not to use

• Private-repo leaks (rewrite plus rotation, no public exposure).
• Keys that were never valid (still rotate to be safe, lower urgency).

Tool compatibility

• GitHub public repos; provider key revocation.

Variant phrasings

key leaked in public github repo

Revoke first.

github takedown request denied

Rotation is the real fix.

Why it happens

Public git history is scraped continuously; removal requests race against copies already made.

Edge cases

• The key may have been used already; check provider audit logs for abuse.
• Archived and mirrored copies persist; assume permanent exposure.
• Enable push protection to prevent recurrence.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_te2y7o-hxKYoxxgG5wTC4Q