When the secret leaks: the hour after exposure

A field guide to the race that starts when a token goes public: who is allowed to kill a credential automatically, how fast the machinery actually works, and why every incident in the corpus was reopened not by slow revocation but by a credential nobody had enumerated. A reader leaves with a decision tree for each credential class they issue, five failure classes with transferable rules, a rehearsal ladder that ends with revoking a production credential on purpose, and the GitHub-native archaeology method that produced the evidence.

What you get out of it

• Platform responses to the same event diverge by revocation blast radius: PyPI deletes the token before emailing, AWS fences a live key behind a 98-action deny list, GitHub auto-kills its own tokens but lets partners decide about theirs.
• CI log masking is literal string matching (documented by the runner maintainer in a 2020 issue that is still open), which is why double-base64 output walked every secret past it in March 2025.
• SHA pinning was defeated three ways in one week: tags rewritten retroactively, a transitive unpinned inner action, and Renovate updating careful repos onto the attacker's hash.
• The strongest recorded fix is credential abolition, not rotation: Nx moved to trusted publishing so no npm token exists to steal; Kubernetes needed five years and two KEPs to do the same for one token class.
• Response automation without an incident mode joins the attack: two projects' bots answered breach reports with marketing and with advice to install the compromised version.

Scope

Why this, now. Between December 2024 and August 2025 four major CI supply-chain compromises left their complete primary records on GitHub, and the platforms' automated responses (trusted publishing, quarantine V3 updates, validity checks) all shifted within the same window.

What it does not cover. Human-credential attacks (phishing, session theft), vault product internals, and the 2022-23 SaaS credential-theft postmortems (Heroku, CircleCI, Cloudflare), which were unreachable from this session's network and are named in the page as an evidence gap.