$150 key lockdown · $999–$2,000 with a host move
Your host had a secrets breach. Treat every key that lived on that host as exposed. Do the step. Write down what you revoked and what you set.
How to check: Write the model providers, Stripe, cloud accounts, database, email, SMS, and the host. For each, name the account and the key. Include the host environment, CI secrets, and keys in git history. The list names keys. It does not store key values.
How to check: From the repo, run gitleaks detect (https://github.com/gitleaks/gitleaks) and trufflehog git file://. (https://github.com/trufflesecurity/trufflehog), which covers the working tree and the git history. Treat every hit as live until you prove it is a fixture.
How to check: On the repo, open Settings, then Advanced Security under Security and quality, and enable Secret Protection. Secret scanning alerts for a public repository can be turned on there. A private repository needs GitHub Secret Protection on the plan. Push protection for the repository is a separate switch and stays off until you enable it. Steps: https://docs.github.com/en/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enable-secret-scanning. Push protection: https://docs.github.com/en/code-security/concepts/secret-security/push-protection.
How to check: Open https://platform.openai.com/api-keys, create a new secret key, put that value in the host env, then revoke the old key on the same page. Open https://platform.openai.com/settings/organization/limits, set a monthly spend limit and an alert, and turn on Enforce a hard limit if requests should fail at the cap. A spend alert does not stop traffic. Hard-limit enforcement is not instantaneous, so recorded spend can pass the number. The clicks are in https://developers.openai.com/api/docs/guides/spend-limits.
How to check: Open https://platform.claude.com/settings/keys, create a new key, update the app, then delete the old key on that page. Open https://platform.claude.com/settings/billing and set a spend limit. It cannot exceed the tier cap. On a workspace that allows it, open https://platform.claude.com/settings/workspaces, select the workspace, and set a spend limit and an alert. The Default Workspace does not take a spend limit. The cap and the alert are described in https://platform.claude.com/docs/en/api/rate-limits.
How to check: Open https://dashboard.stripe.com/apikeys. On the secret key, open the overflow menu, choose Rotate key, and pick an expiration. Now deletes the old key. A later time keeps the old key working until then. Update the server to the new secret key. The only Stripe key in the client bundle is the publishable key (pk_). The rotate steps are in https://docs.stripe.com/keys. Stripe does not offer a spend cap on secret-key use. Under Communication preferences in Personal details, turn on email for successful payments and for disputes, so a person sees charges. That list is in https://docs.stripe.com/get-started/account/teams.
How to check: Create a second access key, update the app, set the old key to Inactive, then delete it. The order is in https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html. In Billing and Cost Management, create a cost budget with an email alert: https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html. The alert notifies. It does not stop spend unless you also attach a budget action.
How to check: Open https://console.cloud.google.com/apis/credentials, open the API key, click Rotate key, update the app, then delete the previous key. For a service-account key, create a new key, update the app, and delete the old key. The rotate clicks are in https://docs.cloud.google.com/docs/authentication/api-keys. Create a budget and an email alert at https://console.cloud.google.com/billing/budgets. An alerts-only budget does not stop spend. The rules are in https://docs.cloud.google.com/billing/docs/how-to/budgets.
How to check: One line per old key: provider, account, key name or last four, time revoked, and the page you used. No key values. Leave the list where the next person can open it.
How to check: The new host gets only the new keys. Copying the old environment copies the exposed keys. Section 01 is the whole of the $150 tier, and it is the first half of this one.
How to check: Create a new project on the new host and deploy the app there with the new keys. Railway is one example of a host you move an app to or from. Do not import the old env file. After the new host answers, delete the environment on the breached host.
How to check: When the new host answers on its own URL, change the DNS record to it. Confirm the domain serves the new host, then delete the old service.
How to check: Call one revoked key and write down the rejection. Re-run gitleaks detect and trufflehog git file://., then confirm the spend limits and billing alerts are still set on the new keys. The pre-launch checks for a cold scan and a written key list are at https://josephdecker.app/prelaunch/.
[email protected] - subject: Breach response
Key lockdown is $150. Key lockdown plus moving the app off the breached host to a new one is $999–$2,000. The quote inside that range names the services that move. Pre-launch checks are at https://josephdecker.app/prelaunch/. Written audits are at https://josephdecker.app/audit/.