Skip to content

How to handle a committed secret

A credential reached a commit and a gate reported it: the pre-commit hook rejected the commit, the Scan Secrets step failed a pull request, or Scan Secrets History found one in the past. This recipe takes you from the report to a clean state. The order matters: rotate first, clean up second.

Prerequisites

  • The finding: rule id, file, line (from the hook output, the Code Insights report on the PR, or the pipeline log).
  • Admin access wherever the credential is valid (Salesforce org, Bitbucket, the external service).

1. Decide whether the value is live

A pre-commit rejection means the value never left your machine: skip to step 4. Anything the pipeline reported has been pushed and is compromised, whatever happens next.

2. Rotate the credential

Revoke or regenerate where the value is valid, before touching the repository:

Rule id Where to act
salesforce-refresh-token / SalesforceRefreshToken Salesforce → Setup → Connected Apps OAuth Usage: revoke the app's tokens for that user
salesforce-access-token / SalesforceAccessToken Salesforce → Setup → Session Management: end the session; the user re-logs
salesforce-consumer-key / salesforce-credential-element Salesforce → the connected app, external client app or auth provider: rotate key and secret
bitbucket-access-token / atlassian-api-token Bitbucket → Repository settings → Access tokens, or Atlassian account → API tokens: revoke
private-key / PrivateKeyBlock Regenerate the key pair; upload the new certificate wherever the old one was registered
generic-api-key / GenericCredentialAssignment The external service's console

3. Tell the owner

Inform the service owner and note the finding in the incident channel, even if you rotated within minutes.

4. Remove the value from the source

Replace the literal with the mechanism that fits:

  • Salesforce callout credentials → Named Credential / External Credential (the value lives in the org, never in metadata).
  • Per-environment values in metadata → a placeholder plus a value replacement.
  • Connected app / external client app consumerKey and consumerSecret → delete the elements; Salesforce generates them on create and keeps them on update.
  • Auth URLs, tokens, keys used by scripts → repository or deployment variables (see authenticate CI to an org).

Commit the fix. Both gates rescan the changed lines.

5. Decide about the history

Default: leave history. Rewriting needs a force push and fresh clones — treat it as a separate change.

False positives

A placeholder that resembles a credential must carry the marker DO-NOT-USE in its value; both gates allowlist that marker. For a genuine non-secret that a rule still matches, add a path or regex entry to the [allowlist] section of .gitleaks.toml and, for the pre-commit layer, an ignores.files entry or a tightened rule in code-analyzer/code-analyzer.yml (exclude files from lint rules). Never allowlist a real credential.