Northflank’s breach is a good reminder to have a rotation drill ready before you need it. This is the generic version I’d follow on any platform that stores env vars for me.
1. List what’s at risk (names only)
# From your repo/deploy configs, list secret-looking variable NAMES, not values
grep -rhoE '^[A-Z0-9_]*(KEY|TOKEN|SECRET|PASSWORD)[A-Z0-9_]*=' .env* deploy/ 2>/dev/null | cut -d= -f1 | sort -u2. Rotate in the right order
- Create the new key at the provider (AI API, database, cloud, SMTP).
- Update it on the platform and redeploy.
- Confirm the app works on the new key.
- Revoke the old key. Rotation without revocation does nothing.
3. Check the bill
Look at each AI provider’s usage and billing page for spikes, unknown models or odd hours. Set a hard monthly spend limit where the provider supports one.
4. Make the next one smaller
- One key per app or bot, named so you know what it is. Revoke one without breaking everything.
- Give keys only the scopes they need.
- Scan your git history too, in case a key ever got committed. See my earlier how-to on that.
My take
Write the list of where every key lives now, while you’re calm. At 2 AM during a breach, you’ll be glad you did.
Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.
God Bless, and Use the Source!
