3 ms·
And obviously rotate the exposed credentials - because even if it was only public for "a while" it could have been viewed by many users.
by stevekemp 8y ago
And obviously rotate the exposed credentials - because even if it was only public for "a while" it could have been viewed by many users.
- meowface 8y agoPlus it could've been archived by another website or a private scraping tool which looks for exactly these sorts of exposures. Removing it from the git history is almost irrelevant and just stops future people who find it from sniffing around. The crucial part is rotating the credentials and ensuring the credentials aren't used anywhere else. The second step should be reviewing all logs to ensure no unauthorized logins occurred before the credentials were changed (even if the exposure was only exploitable for a few seconds).