01
Identify secret type, scope and privilege
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.
GitHub Actions Academy · Security Playbooks
Secrets Exposure Playbook
Respond to leaked keys, tokens, passwords or certificates.
Objective: Invalidate exposed secrets and prove that dependent systems are secure.
Practical guidance
Immediate action
02
Revoke or rotate the exposed material
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.
03
Search repositories, logs and build artifacts
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.
04
Block further distribution and preserve evidence
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.
Practical guidance
Prevention
01
Move secrets to managed stores
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.
02
Enable automated secret scanning
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.
03
Shorten credential lifetime and scope
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.
04
Add rotation tests and ownership records
Apply this point to a real GitHub Actions Academy design, delivery or operational scenario and record the evidence used to validate the outcome.