What is the recommended action when a secret is detected?

• A. Rotate or revoke the secret, remove it from the repo, purge history if needed, and implement secret management
• B. Ignore and continue
• C. Change the file name only
• D. Move secret to a public repo

Answer: (B)

When a secret is detected, the immediate priority is to reduce risk by invalidating the exposed credential and preventing further misuse. The best action is to rotate or revoke the secret, remove it from the repository, and purge its history if it was committed, so the sensitive data isn’t recoverable from prior revisions. After that, implement proper secret management—use a centralized secret store or vault, inject secrets at runtime (not in code), and enforce rotation policies to prevent future exposures. Ignoring the secret, renaming the file, or moving it to a public repository would leave the credential exposed and create a serious security vulnerability.