Should I rotate before or after removing the secret from code?

Rotate first. Rotation kills the leaked value's usefulness immediately, limiting blast radius while you clean up the repo and history.

Is deleting the file enough?

No. The value stays in git history and any fork. Rotate it and rewrite or purge history where policy allows; at minimum, the rotated value is dead.

What's the point of pre-commit scanning?

It catches the next accidental commit before it reaches the remote — detection plus prevention, so the credential doesn't return.

Does EnvLens fix the credential for me?

No. EnvLens flags the finding and gives a prioritized remediation checklist. Rotation, history purge, and secret-store setup stay with your team.

Is EnvLens a security guarantee?

No. EnvLens is a config scanner that surfaces exposed secrets and insecure settings. It is decision-support, not a penetration test, an audit, or a guarantee of a breach-free system.

How to remediate hard-coded credentials

---

The remediation sequence

Finding a hard-coded credential is only the start. The fix is a four-step sequence that closes the exposure today and prevents it tomorrow. Do them in order — rotating first limits the blast radius while you clean up.

Step 1 — rotate immediately

Assume the exposed value is already in the hands of a scanner. Rotate the credential at the provider (Stripe, AWS, OpenAI, DB) so the leaked value stops working. This is the single highest-leverage action and should happen before anything else.

Step 2 — remove from repo and purge history

Delete the credential from the file, then address history. A plain git rm leaves the value in past commits and every fork. Rewrite history (e.g., git filter-repo) or, more simply, rotate so the old value is dead and document the exposure. Force-push with care and notify collaborators.

Step 3 — inject via environment or secret store

Read the value from an environment variable or a secret manager (Vault, cloud secret manager, CI secrets) at runtime. Nothing credential-shaped belongs in source. EnvLens flags the finding; your deploy pipeline supplies the real value.

Step 4 — add pre-commit scanning

A pre-commit hook (gitleaks, trufflehog, or similar) catches the next accidental commit before it lands. This is what keeps the credential from returning — detection after the fact plus prevention at commit time.

What scanning cannot do

A scanner shows what is exposed and what to rotate; it does not rotate, purge history, or configure your secret store. Those remain engineering tasks. A clean scan also is not proof of safety — it covers config you scanned, not every path an attacker might use.

Authoritative references

OWASP Secrets Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
CWE-798 (Hard-coded credentials): https://cwe.mitre.org/data/definitions/798.html
OWASP Top 10 (A07 Identification and Authentication Failures): https://owasp.org/Top10/