That one change from two years ago
The key was deleted, but the version history remembers everything.
(Illustrative scenario, not a real incident)
To show off its work,this ten-person app studiomade an old project public.
A few days later, the cloud bill looked wrong.Someone had used their keyto spin up a large amount of compute.
Tracing it back,they found the key hidden in a change from two years earlier.Later versions had long since deleted it,but the version history remembered everything.
“Hard-code it for now, fix it later.”Nearly every engineer has said it.Database passwords, service keys,go into a .env file first.Getting the feature working is what matters.
Then one daythe ignore list is missing a line,or someone switches the project from private to public,and the key walks out the door along with the code.
Public code is scanned constantly.Private code isn’t safe either:contractors, people who have left, compromised accountscan all see it.
I used to think deleting something made it gone.Later I realizedthe greatest strength of version controlis that it remembers everything.So is its greatest risk.
Words once spoken can’t be taken back.Neither can a key once pushed.
When a key leaks, the first step is to revoke and replace it, not to delete that line; then add .env to the ignore list, and scan the history before making any project public.