You discover that a secret (e.g., a token or password) was accidentally committed to a GitHub repository. What is the first step you should take to mitigate the risk?

Question

Options

• AContact GitHub Support to remove the secret from all forks and clones of the repository.
• BRevoke and/or rotate the secret to render it unusable, then assess whether history rewriting is
• CRewrite the repository history using git filter-repo or BFG Repo-Cleaner to remove the secret from
• DDelete the repository and create a new one to ensure the secret is no longer accessible.

• A
  8% (2)
• B
  72% (18)
• C
  16% (4)
• D
  4% (1)

Explanation

Revoking and rotating the secret (B) is correct because it immediately neutralizes the threat - even if the secret has already been seen by malicious actors, a revoked token or rotated password is useless. This is the highest-priority action since history rewriting and cleanup can follow, but a live compromised credential causes harm every second it remains valid.

Why the distractors are wrong:

• A (Contact GitHub Support) - GitHub cannot remove secrets from forks, clones, or caches you don't control; this is slow and unreliable as a first step.
• C (Rewrite history) - Cleaning git history is important but is a second step; the secret is still active and dangerous while you're rewriting commits.
• D (Delete the repository) - Deleting does nothing about forks, clones, or caches that already contain the secret, and is destructive overkill.

Memory tip: Think "Stop the bleeding first, then clean the wound." Revoke/rotate = stopping the bleeding (the credential stops working instantly). History rewriting = cleaning the wound (removes the secret from the record). You always stop the bleeding before surgery.

No community discussion yet for this question.