Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume the key is compromised. Revoke or delete it in the provider console immediately, preserve evidence, inspect usage and billing, create a replacement with tighter controls, update every application and deployment secret, verify requests, and only then remove the old credential from remaining systems. Deleting a leaked file or Git commit does not invalidate a live key.
This procedure applies to keys for OpenAI, Anthropic Claude, Google Gemini and similar AI services, whether the exposure occurred in a public repository, browser bundle, mobile app, log, ticket, chat, notebook or third-party tool.
1. Contain access before investigating
A key is a bearer credential: whoever possesses it may be able to authenticate until the provider revokes it. Do not make a test request to see whether the leaked value still works. That creates another request while the credential may already be in hostile hands.
Recommended Free Tools
- Revoke or delete the exposed key. Open the provider’s API-key or credentials console, identify the affected project or workspace, and delete the key. Anthropic recommends immediate revocation for a suspected compromise. OpenAI instructs users to delete the affected key, review usage and contact support. If the provider has a dedicated disable or revoke action, use it rather than merely hiding the value.
- Preserve evidence before it disappears. Record the discovery time, the location of the leak, the project or workspace, the key prefix or identifier (never the full secret), and any provider request IDs. Keep screenshots or an access-controlled copy of the exposed material for investigators. Do not paste the secret into a new ticket or incident channel.
- List every copy. Treat values in source files, Git history, pull-request comments, CI logs, build artifacts, browser bundles, mobile packages, notebooks, local shell history, support tickets and shared chats as exposed. A key copied into a third-party integration must be considered compromised even if the original file is private.
- Check for misuse. Review the provider’s usage dashboard, request logs, billing, quota consumption, rate-limit events and security history. Capture unfamiliar timestamps, models, endpoints, regions, IP information and spend where the service supplies them.
- Save the incident timeline. Note when the key was created, when it was last known to be safe, when the leak was discovered, when it was revoked and when replacement credentials were deployed. This prevents gaps when you later compare logs or answer provider-support questions.
- Escalate promptly. Contact provider support if you see unauthorized activity, financial loss, account compromise or uncertainty about whether revocation succeeded. Include the affected project, time range, request identifiers and evidence, but never send the secret itself.
2. Understand what revocation does—and does not do
Revocation stops future authentication with that credential. It does not erase requests already made, reverse charges automatically, remove copies from logs or repositories, or prove that no one used the key before it was disabled. Removing a line from the current file, deleting a branch or rewriting a public page is cleanup, not access control.
Popular on Amazon
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
OpenAI warns that exposing a key in a browser or mobile application allows malicious users to make requests on your behalf and can lead to unexpected charges or compromise of certain account data. Google Cloud similarly warns that public keys can produce unexpected charges or unauthorized data access. Anthropic states that expiration limits the lifetime of a leaked credential but is not a substitute for secret hygiene.
3. Provider-specific response paths
OpenAI API keys
Delete the affected key through the API-key dashboard. Then review API usage for unexpected activity and retain the details. OpenAI’s published guidance also tells customers to contact support. Keys detected on the public internet or in app stores may be disabled automatically, but do not rely on detection; revoke the credential yourself and rotate every dependent application.
For the replacement, OpenAI recommends environment variables rather than embedding secrets in source or client code. Separate keys by project or environment, set spend thresholds and hard limits where available, use IP allowlisting for server workloads, and consider workload identity federation when your deployment platform supports it.
Anthropic Claude keys
In the Claude Console, revoke a suspected key immediately. Review Logs and Usage for unfamiliar requests, models, time ranges and spending. Anthropic recommends encrypted secret storage, separate keys, repository and CI scanning, workspace or spend limits and regular rotation.
Also popular on Amazon
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Claude keys can have expirations. An expiration reduces how long a stolen value can be used, but it does not remove the need to keep the value out of source, client bundles and logs. Anthropic also documents workload identity federation as a way to obtain short-lived access tokens instead of distributing long-lived secrets.
Google Gemini and other Google API credentials
In Google Cloud’s credentials controls, create a replacement key, update applications, verify traffic, then delete the old key. Google recommends deleting unneeded keys and restricting active ones by IP address, referrer or application and by the specific APIs they may call.
Do not place Google API keys in client code, repositories or URL query parameters. A restriction that limits an otherwise exposed key can reduce the blast radius, but it is not a reason to leave a known-compromised value active; rotate it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keys found through GitHub
If an AI-provider key appears in a GitHub repository or commit, use the provider’s own revocation flow. GitHub documents a credential-revocation endpoint for exposed GitHub credentials and says revoked GitHub credentials cannot be reactivated; that process does not revoke an OpenAI, Anthropic or Google key. Enable GitHub secret scanning and scan the repository’s history, pull requests, issues and Actions logs. Removing the commit alone cannot stop abuse.
Also popular on Amazon
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
4. Investigate whether the key was used
Investigation is most useful after containment, because revocation freezes the credential while preserving the provider’s historical records. Export or securely record the following information before dashboards age out:
| Evidence | What to look for | Why it matters |
|---|---|---|
| Usage and request logs | Requests outside your normal schedule, model or endpoint mix, unusual volume, regions or IP addresses | Shows whether the key authenticated and how it was used |
| Billing | Unexpected spend, new services, sudden token consumption or charges after the exposure time | Quantifies possible financial impact |
| Quota and rate limits | Spikes, exhausted quotas, throttling or limit changes | Can reveal automated abuse even when billing is delayed |
| Security history | Credential changes, sign-ins, project changes or alerts you did not initiate | May indicate broader account compromise |
| Deployment records | Which environments still referenced the old key and when each was updated | Identifies remaining access paths and explains legitimate traffic |
Compare provider records with your own application logs, deployment timestamps and release history. Mark known-good requests so investigators do not mistake normal traffic for abuse. Preserve timestamps with their time zone, and keep provider request IDs whenever they are shown. If the provider does not expose a particular field, record that limitation rather than inferring an attacker’s location or identity.
5. Create and deploy a replacement safely
- Choose the smallest practical scope. Grant only the APIs, projects and operations that the workload requires. Use separate credentials for production, staging, development, notebooks, experiments, teams and individual operators.
- Set a lifetime. Use an expiration date or short-lived token where the provider and deployment platform support it. For machine-to-machine workloads, prefer workload identity federation or another short-lived identity mechanism over a permanent shared secret.
- Store the new value centrally. Put it in an encrypted secrets manager or KMS-backed store. Inject it at runtime as an environment variable or platform secret. Do not commit the value to configuration files, container images, frontend bundles or URL parameters.
- Map every consumer. Update production and staging services, development machines, CI/CD variables, serverless settings, containers, scheduled jobs, notebooks and local environment files. Include hidden deployment copies and rollback configurations.
- Deploy in a controlled order. Change the secret in the managed store, redeploy or restart consumers, and verify a normal request from each environment. Watch logs and billing during the rollout for authentication failures or unexpected traffic.
- Remove the old credential. After all consumers succeed with the replacement, delete or revoke the old key if it was not already revoked. Keep the incident record and key identifier, not the secret value.
- Test failure handling. Confirm that an expired or revoked key produces a controlled authentication error and that your service does not silently fall back to a hard-coded backup.
| Environment or location | Rotation action | Verification |
|---|---|---|
| Production services | Update the platform secret and redeploy | Successful authenticated request and normal error rates |
| Staging and development | Replace environment variables and local secret-store entries | Test call uses the new key identifier |
| CI/CD | Change repository or organization secret and rebuild | Pipeline completes without printing the value |
| Serverless and containers | Update function settings, task definitions or orchestrator secrets | Fresh instance receives the replacement at runtime |
| Notebooks and scripts | Remove embedded values and load from managed storage | Run with a clean environment and inspect output for leakage |
| Client applications | Move calls behind a server you control; do not ship a provider key | Inspect the built bundle or package for secret-like strings |
6. Clean the leak everywhere it can be reached
Current files and reachable history
Remove the secret from the working tree, all branches, tags, pull requests, issue comments, release assets, generated documentation and build caches. Scan the complete repository history, not only the default branch. History rewriting may be necessary, but it is still secondary to revocation because forks, clones, caches and screenshots may retain the old value.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Logs, artifacts and collaboration tools
Search CI output, deployment logs, crash reports, ticket attachments, chat messages, shared documents, container layers, notebook outputs and browser developer tools. Restrict access to preserved evidence, redact the secret from incident notes, and ask administrators to purge copies according to their retention policy.
Also popular on Amazon
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Secret scanning
Run repository and CI secret scanning after cleanup and schedule it continuously. Anthropic specifically recommends source-control scanning, Gitleaks and CI integration. Test scanners against a deliberately fake value so a new pipeline proves it can block future commits without handling a real credential.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Harden the replacement and reduce blast radius
| Control | Implementation | Failure it addresses |
|---|---|---|
| Managed encrypted storage | Secrets manager or KMS with audited access | Keys copied into source, images or shared files |
| Least privilege | Restrict project, API, operation and environment scope | A stolen key reaching unrelated workloads |
| Network restrictions | IP allowlists, application or referrer restrictions where supported | Use from an unexpected network or client |
| Spend and rate controls | Budgets, spend thresholds, hard limits and provider rate limits | Runaway token use and surprise charges |
| Expiration and rotation | Short lifetimes, scheduled replacement and documented ownership | Long-lived credentials remaining valid unnoticed |
| Monitoring | Alerts for new regions, models, volume, quota and billing anomalies | Delayed detection of abuse |
| Short-lived identity | Workload identity federation or equivalent tokens | Static secrets distributed to machines |
| Automated scanning | Pre-commit, pull-request and CI checks | Accidental reintroduction into repositories or logs |
Use a distinct credential for each project, environment, feature or team member. This makes revocation targeted and gives usage records enough separation to identify the affected workload. Document who owns each key, where it is injected, its expiration date and the exact rotation procedure.
8. Common leak scenarios and the right response
Public repository or pull request
Revoke first, then remove the value from the current tree and history, scan forks and CI logs, and redeploy a replacement. Notify maintainers if someone else may have cloned the repository. Do not assume a force-push removed cached copies.
Browser or mobile application
Treat the key as permanently public. Users can inspect shipped code, network calls and decompiled packages. Revoke the credential, move provider calls to a server-side component, and issue a replacement that is never included in the client bundle.
Also popular on Amazon
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Log, ticket or chat message
Revoke immediately, restrict the conversation or ticket, request deletion from administrators, and preserve a redacted incident record. Check exports, notifications and integrations that may have copied the message.
Third-party tool or contractor
Revoke the key, identify every integration that received it, and review its access and retention controls. Ask the third party to delete copies, but do not wait for confirmation before rotating.
9. When the incident is larger than one key
Escalate as an account-security incident if you find unauthorized project changes, unfamiliar sign-ins, altered billing settings, new users, disabled limits or activity continuing after key revocation. Rotate related credentials, review organization and workspace audit records, and involve your security, finance and legal contacts according to your incident plan.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Provider guidance supplies operational steps, not a universal breach rate, average loss or guaranteed response time. Your own timestamps, usage records and billing data are the evidence for determining impact in this event.
Quick Recap
10. A compact prevention checklist
- Keep AI credentials only in encrypted, access-controlled secret storage.
- Never put provider keys in browser code, mobile packages, repositories, URLs, screenshots or logs.
- Use separate, least-privileged keys for each project and environment.
- Enable provider restrictions, budgets, hard limits, rate limits and expiration where available.
- Run secret scanning in repositories and CI, including full history scans after an incident.
- Monitor usage, logs, quota, billing and security events with alerts.
- Document owners, consumers, expiration dates and the exact rotation sequence.
- Practice replacing a key before an emergency so every deployment path is known.
