## TL;DR

Once a key is in a public repo, assume it is compromised: scrapers copy public commits within minutes. Revoke and rotate the key immediately, then pursue removal of the content as hygiene, not as containment.

## Error

```text
api key committed to public repo: takedown failed
```

## Steps

1. Revoke the exposed key at the provider now. Expected: the key is dead regardless of who copied it.
2. Issue a replacement and update all consumers. Expected: services run on the new key.
3. Remove the key from the repo history (rewrite and force-push). Expected: the value no longer in the codebase.
4. Request takedown or cache purge from the host for the exposed content. Expected: best-effort removal; treat failure as expected.
5. Search for forks and mirrors that copied the commit; notify or accept the exposure. Expected: realistic containment assessment.

## When to use

- API keys exposed in public repos.
- Any public leak where takedown is uncertain.

## When not to use

- Private-repo leaks (rewrite plus rotation, no public exposure).
- Keys that were never valid (still rotate to be safe, lower urgency).

## Tool compatibility

- GitHub public repos; provider key revocation.

## Variant phrasings

### key leaked in public github repo

Revoke first.

### github takedown request denied

Rotation is the real fix.

## Why it happens

Public git history is scraped continuously; removal requests race against copies already made.

## Edge cases

- The key may have been used already; check provider audit logs for abuse.
- Archived and mirrored copies persist; assume permanent exposure.
- Enable push protection to prevent recurrence.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_te2y7o-hxKYoxxgG5wTC4Q