A teammate pasted a production API key into a chat with the coding assistant. What do you do?

Question

Accepted Answer

Rotate the key immediately — assume compromise. Remove the secret from chat history if the vendor allows; otherwise treat the thread as burned. Add secret scanning on IDE + CI; educate on env vars and secret managers. Rotation over debate. Understands vendor retention policies. Prevents recurrence with tooling. No blame — focus on incident response speed.