Confirm the finding without spreading it
Identify the credential type, the shipped artifact and the permissions it grants. A scanner match may be a test token or public identifier, so confirm it through the service owner’s approved process. Do not validate by making unapproved requests against third-party accounts.
Store the artifact identifier, a redacted finding and discovery time in your restricted incident record. Avoid copying raw credentials into a public issue, analytics event or chat transcript. CloneGuard findings redact matched values, but the original release still needs careful handling.
Contain the privileged access
Use the provider or internal credential system to revoke or rotate the exposed credential. Consider the consuming service’s availability requirements and coordinate the replacement so a hurried change does not silently break production jobs. Removing a string from JavaScript does not invalidate copies already downloaded.
Review the credential’s permitted resources, lifetime and account activity using authorized logs. If the same key was reused across environments, inventory those consumers as well. Follow the organization’s incident response process for notification and data impact assessment rather than inferring impact from the scanner alone.
Correct the publication path
Find how the value reached the client. Common routes include public environment prefixes, broad configuration serialization, committed environment files, copied archives and generated source maps. Correct the originating build or trust-boundary error instead of relying on a final search-and-replace.
If the browser needs the underlying operation, move its authority to a server endpoint that checks the authenticated account and permitted action. Keep any client identifier nonprivileged. Add an intentional synthetic-value test that fails when a private sentinel appears in the public output.
Verify the replacement and the historical surface
Rebuild in a clean workspace, audit the exact public artifact and deploy through the normal rollback-capable path. Request old and new asset URLs on authorized origins, including separate CDNs, service-worker caches and static download archives. Cache invalidation is useful containment but cannot recall copies that people already saved.
Record the revoked credential identifier, replacement release receipt and validation outcome. A passing new scan means the tested output no longer contains the recognized exposure; it does not certify that no credential was misused or that every secret pattern has been detected.
Close the incident with an explicit boundary
Choose a bounded completion statement: the credential was revoked, the publication path was corrected, the replacement release was deployed, and the listed origins were checked at a recorded time. State any remaining uncertainty about cached copies or unavailable logs. This is more useful than declaring the entire application safe. A follow-up owner can then address wider work such as credential reuse, build permission reduction or historical artifact retention without delaying the essential containment actions. Keep the raw compromised artifact only where authorized investigators can access it and follow your organization’s evidence-retention rules.
Practical checklist
- Confirm what authority the matched value grants.
- Use redacted evidence and restricted access.
- Revoke or rotate through the credential owner.
- Test the corrected build path with a harmless sentinel.
Sources and further reading
Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.
Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.