The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume the credential is compromised. Revoke or rotate it with the issuing provider first, then replace every stored copy, remove it from the repository and its history, handle Actions logs and artifacts, investigate possible use, and verify that the old value is rejected. Editing a file or rewriting Git history does not invalidate a token that the provider still accepts.
GitHub’s incident guidance puts the rule plainly: “Any credential that may have been exposed should be treated as compromised and rotated or replaced immediately.” The sequence below applies whether the value was committed to a repository, printed by a workflow, embedded in an artifact, or exposed through a pull request or fork.
What to do in the first 15 minutes
- Stop treating the value as private. Do not paste it into another issue, chat, ticket, or debugging command. Record only a fingerprint or the last few characters needed to identify it.
- Identify the issuer and credential. Note the provider, account or service owner, scopes, environments, expiration policy, and every system that might use it.
- Revoke or rotate at the provider. Invalidate the old credential before cleaning GitHub. If the provider separates revocation from issuance, revoke first and create a replacement with the minimum required scope.
- Preserve investigation evidence carefully. Record the repository, workflow run, job, commit, branch, pull request, exposure time, and the old credential’s identifier. Preserve relevant logs or screenshots in an access-controlled location before deleting public workflow logs.
- Disable dependent jobs if necessary. If the credential can alter production data, deploy code, create users, or access customer information, pause the affected workflow or integration while the replacement is tested.
Do not wait for a secret-scanning alert to prove that the value was used. Exposure alone is enough to require rotation.
Why deleting the text does not fix the credential
Git stores committed content in an object database. Removing a key from the current file leaves earlier commits, tags, pull requests, forks, caches, generated files, and downloaded artifacts as possible copies. A person who already cloned the repository also has their own copy.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Those copies matter for confidentiality, but they are separate from the credential’s validity. GitHub cannot revoke a cloud API key, database password, signing key, or personal access token merely because a commit was edited. Only the issuing provider can reject the old value. Rotate first; repository cleanup is still required to reduce future exposure.
A history rewrite is conditional, not a substitute for rotation:
- If the value exists only in the latest unmerged commit, remove it, amend the commit, and push the corrected commit.
- If it appears in earlier commits or other reachable refs, remove it from every affected commit and ref. Coordinate a force push and ask collaborators to reclone or carefully clean their local copies.
- If it reached a public pull request, fork, Actions log, artifact, cache, or external system, a Git rewrite cannot erase those copies. Handle each location separately.
Identify exactly what was exposed
Classify the value before choosing the replacement. A short-lived job token has a different response from a long-lived personal token, but both must be assessed as exposed.
| Credential or value | What to record | Immediate provider action |
|---|---|---|
| GitHub personal access token | Token owner, classic or fine-grained type, repositories, organization access, scopes, and expiration | Delete the compromised token and create a new one with only required access |
| GitHub App or installation credential | App identity, installation, permissions, and affected organizations or repositories | Revoke or regenerate according to the app’s credential controls, then review installation permissions |
| Cloud, SaaS, or database API key | Account, project, regions, environments, scopes, quotas, and dependent services | Revoke or roll the key at that provider and issue a least-privilege replacement |
| Password or connection string | User, host, database, roles, and every application using the value | Change the password or rotate the connection credential, then update all consumers |
| Private signing or encryption key | Algorithm, key identifier, certificates, data signed or encrypted with it, and trust relationships | Revoke the key or certificate and follow the provider’s re-key and re-encryption procedure |
| Generated token, JWT, or session value | Issuer, audience, expiry, signing key, and services that accept it | Revoke the issuer or signing key when possible; otherwise disable the accepting integration and issue replacements |
GITHUB_TOKEN |
Repository, workflow, job, permissions, and run time | Usually allow the job to end or cancel it; investigate any actions performed while it was valid |
The default GITHUB_TOKEN is job-scoped and expires after the job or its effective lifetime. Personal tokens, GitHub App credentials, and third-party credentials generally remain valid until their provider revokes them or their natural expiration arrives. Do not assume that because a workflow finished, every value printed by it has expired.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Revoke and issue the replacement
1. Use the issuer’s control plane
Sign in to the service that issued the credential, locate the exact token or key by owner and identifier, and revoke it. If the provider offers a rotate operation that keeps an overlap window, use the shortest practical overlap and set an explicit deadline for deleting the old value. When separate controls exist, revocation should happen before reissuance.
2. Minimize the replacement
- Grant only the repositories, projects, environments, API operations, and data the consumer needs.
- Set an expiration date when the provider supports one.
- Create separate credentials for development, staging, and production rather than reusing one value.
- Use a service identity instead of a personal account when the integration supports it.
3. Test without re-exposing it
Update one controlled consumer first and make a non-destructive request. Do not place the new value in a command line that will be captured by shell history or in a workflow step that prints its environment. Confirm the old identifier is rejected before removing any temporary overlap.
Replace every GitHub-held copy
After the issuer has rejected the old value, update all locations that supplied it to code or automation:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Repository secrets at the repository level.
- Organization secrets and their repository access policies.
- Environment secrets, including protection rules and required reviewers.
- Deployment-system variables, external secret stores, and cloud integrations.
- Local development files, CI configuration, generated configuration, and infrastructure state.
- Reusable workflows and composite actions that receive the value as an input.
Keep sensitive values out of workflow source. GitHub recommends storing them as secrets and registering generated sensitive outputs as secrets as well. Check the name and scope of each secret: a workflow can silently fall back to an empty value when a secret is unavailable, while a broad organization secret can expose more repositories than intended.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Remove the value from Git history
When only the newest commit contains it
Delete the value from the file, replace it with a secret reference, inspect the diff, amend the commit, and push the corrected branch. A typical local sequence is:
git grep -n "EXPOSED_VALUE" -- . ':!.git'
# edit the file and replace the value with a secret reference
git diff --check
git add path/to/file
git commit --amend --no-edit
git push --force-with-lease origin BRANCHUse a distinctive fragment or a token identifier with git grep; avoid putting the complete live secret in shell history. Coordinate the force push with anyone who may have based work on the old commit.
When earlier commits contain it
Search all reachable history and refs, not just the default branch:
git log --all --full-history -S'UNIQUE_FRAGMENT' --onelineFor earlier commits, use an approved history-rewrite procedure to replace the value in every affected commit, then force-push the rewritten branches and tags. A rewrite changes commit IDs and can disrupt open pull requests, release tags, deployment systems, and clones. Notify contributors, invalidate cached checkouts where possible, and verify the rewritten repository no longer contains the value. Even a perfect rewrite does not remove copies already downloaded, so the provider rotation remains mandatory.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Check places Git commands do not cover
- Pull-request descriptions, comments, reviews, and patches.
- Forks and mirrors outside the repository owner’s control.
- Generated files, build output, release bundles, package metadata, and infrastructure state.
- GitHub Actions workflow logs, uploaded artifacts, caches, and deployment records.
- Tickets, chat messages, dashboards, and third-party systems that received the value.
Handle a secret printed in a GitHub Actions run
GitHub normally masks registered secrets, but masking is not proof that the value stayed confidential. A secret can appear before masking is configured, be transformed by a command, or be embedded in structured output that exact-value redaction does not recognize. Treat an unredacted value in a log as exposed.
Preserve evidence, then remove public copies
- Record the run ID, workflow, job, step, commit, actor, timestamps, and the visible value’s location. Preserve the minimum necessary evidence in a restricted incident record.
- Rotate the credential at its issuer.
- Inspect the complete run, including failed and retried jobs, annotations, summaries, and uploaded artifacts.
- Delete the workflow log and exposed artifacts using the repository’s available controls after evidence is preserved. Check whether downstream systems retained copies.
- Search subsequent runs for the value or derived forms.
Do not rely on one masking rule
For a non-GitHub-secret value generated during a job, register it before any command can print it:
echo "::add-mask::$VALUE"Register generated tokens and JWTs as secrets so they can be redacted if they reach output. Avoid storing an entire JSON, XML, or YAML document as one secret: exact-match masking can fail when a command reformats, splits, or escapes the content. Pass individual fields only where possible, and never echo a secret for troubleshooting.
Investigate whether anyone used the credential
Investigation should correlate GitHub evidence with the issuing provider’s security records. A secret-scanning alert can show where a value was found and whether GitHub considers it active, but it cannot establish that no one copied or used it.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
| Evidence source | Questions to answer | Important limitation |
|---|---|---|
| Workflow runs and job logs | Which jobs received the secret, what commands ran, and what outputs or artifacts were produced? | Logs may have been deleted, truncated, or copied elsewhere |
| GitHub audit-log events | Were repository, organization, secret, permission, or workflow settings changed around the exposure? | Retention and event detail vary by account and event type |
| Secret-scanning alerts | Where was the value found, is it marked active or revoked, and what locations remain? | An alert is detection evidence, not proof of use |
| Repository and organization access | Who could read the repository, fork it, view runs, or download artifacts? | Access lists do not show copies made outside GitHub |
| Provider security logs | Were there API calls, sign-ins, source addresses, user agents, permission changes, or unusual regions? | Some providers retain only a limited window or omit detailed request data |
| Deployment and application telemetry | Did the credential create, change, read, or delete anything? | Application logs may use a different clock or omit the credential identity |
Know the log-retention window
GitHub-hosted workflow logs are retained by default for 90 days. Private repositories can be configured for retention of up to 400 days, while public repositories have a 90-day maximum, according to GitHub’s 2026 guidance. Provider logs, audit events, artifacts, and caches can have different limits. Start collection immediately; absence of an old event is not evidence that no use occurred.
Look for impact, not just authentication
Search for successful and failed requests, resource creation, permission changes, data reads or exports, deployments, and billing changes during the period from the first possible exposure until revocation. Compare the credential’s recorded scopes with the actions observed. If the provider cannot distinguish this credential from others, document that uncertainty and investigate the shared account or service identity as a whole.
Validate that recovery worked
- Test the old value. A direct, low-risk request should fail with the provider’s revoked, expired, or unauthorized response. Do not test against a destructive endpoint.
- Test the replacement’s intended path. Run the smallest workflow or application operation that proves the new credential works in the correct environment.
- Check permissions. Review the workflow’s
permissions:block, job-level permissions, environment gates, and every secret available to each job. Remove unused access. - Recheck content. Search the working tree, reachable commits, pull requests, artifacts, logs, and generated output for the old value and recognizable fragments.
- Confirm monitoring. Ensure provider alerts, audit events, and workflow notifications cover the replacement and that an owner is responsible for follow-up.
Keep a dated incident record containing the credential owner, first and last possible exposure, revocation and reissue times, affected workflows, repositories and environments, evidence collected, history-rewrite status, and validation results.
Prevent the next exposure
Turn on detection and push blocking
Enable Secret Protection and secret scanning wherever the repository and account plan support them. Enable push protection so supported secrets are blocked before they enter the remote repository. If a contributor bypasses a push-protection block while repository protection is enabled, GitHub creates a push-protection alert; review the bypass rather than treating it as an approval that the value is safe.
Design workflows for least privilege
- Set explicit job permissions instead of relying on broad defaults.
- Give a job only the secrets it needs and separate production environments behind protection rules.
- Use short-lived, narrowly scoped credentials where the provider supports them.
- Keep secret values out of command arguments, URLs, debug output, artifacts, and cache keys.
- Review reusable workflows and third-party actions as code that can receive every input and secret you pass.
Make masking a backstop, not a storage strategy
Store sensitive values as secrets, mask generated values before use, and avoid putting complete structured documents into a single secret. Masking reduces accidental log disclosure; it cannot protect a value that is committed, deliberately printed, transformed, or copied into an artifact. Secret scanning and push protection reduce recurrence risk, but neither replaces immediate rotation after a leak.
Quick Recap
Incident checklist
- Issuer and credential type identified.
- Old credential revoked or rotated at the provider.
- Replacement created with minimum scope and an expiration policy where available.
- Repository, organization, and environment secrets updated.
- Deployment systems, local files, generated files, and external stores updated.
- Current files and every affected commit cleaned.
- Pull requests, forks, artifacts, caches, logs, and third-party destinations checked.
- Exposed logs and artifacts deleted after evidence preservation.
- Workflow permissions and per-job secret access reviewed.
- GitHub runs, audit events, secret-scanning alerts, repository access, and provider logs correlated.
- Old value tested and rejected; replacement tested only in intended environments.
- Incident owner, timestamps, findings, and follow-up actions documented.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
