Keys and secrets
You committed a secret: revoke, replace, clean up
- What you see
- A key or password is in a file that was committed, maybe already on GitHub.
- Why it happens
- The secret wasn't in an ignored file. Once pushed, assume someone has seen it.
- How to fix it
- Revoke the key on the provider's website first. This matters most.
- Create a new key and store it only in Vercel and
.env.local. - Ask your agent to remove it from the code, add the file to
.gitignore, and explain your options for the history.
Message for your agent
I committed a secret and I've already revoked it. Remove it from the code, make sure the file is ignored, and explain my options for the Git history in plain words before changing anything.
Safety
How to prevent it: Secrets only ever live in .env.local and Vercel.
Was this page helpful?