Secret Leak Remediator

A safe, agentic workflow that detects leaked API keys, rotates them, verifies the replacement, and revokes the exposed credential.

Comment

Project title

Secret Leak Remediator: Rotate Before the Attacker Does

About the project

Secret Leak Remediator

The first minute of a leak matters

A leaked API key can become an expensive security incident within seconds. Automated scanners continuously search public repositories, and a single exposed credential can lead to unauthorized API usage, data access, or unexpected cloud charges.

Secret Leak Remediator is an agentic security workflow that detects an exposed credential, creates a replacement, verifies the new credential, updates secure storage, and revokes the compromised credential only after the replacement is healthy.

The goal is simple:

Turn a secret leak into a controlled, observable, and reversible recovery process.

Inspiration

The project was inspired by a common incident-response problem: security teams often discover leaked credentials quickly, but the remediation process still requires many manual steps.

An operator may need to:

  • Identify the leaked credential
  • Determine which services are affected
  • Create a replacement credential
  • Update secret storage
  • Deploy the new configuration
  • Verify that services still work
  • Revoke the exposed credential
  • Report the incident

Every manual step increases the window of opportunity for an attacker.

I wanted to explore whether an agentic workflow could coordinate these steps while enforcing strict safety boundaries.

How it works

The workflow follows a guarded rotation sequence:

  1. A signed webhook is received.
  2. The payload and repository are validated.
  3. The credential type and impact scope are identified.
  4. A replacement credential is created with the narrowest supported permissions.
  5. The replacement is written to secure storage.
  6. A health check verifies that the new credential works.
  7. The exposed credential is revoked only after the health check succeeds.
  8. A sanitized incident report is generated.

The most important safety rule is:

verify(new credential) → revoke(old credential)

The system never stores raw credentials in the incident evidence, public dashboard, logs, or demo fixtures.

## Public demo

The public demo is intentionally safe for judges.

It uses:

- A synthetic incident fixture
- A mock provider
- Sanitized event data
- A public Cloudflare Worker
- Persistent demo state
- No production credentials
- No GitHub Actions dependency

Judges can open the demo and run the test flow without creating an account or submitting a real API key.

Public demo:

https://secret-leak-remediator-demo.secret-remediator-demo.workers.dev

The public demo demonstrates the complete orchestration flow, including detection, replacement, health check, revocation state, and the final
incident result.

## Architecture

The project is implemented as a serverless TypeScript application.

- Cloudflare Workers handles the webhook and public demo API.
- Cloudflare KV stores sanitized demo incident state.
- Hono provides the HTTP routing layer.
- Provider boundaries isolate GitHub, Vault, Vercel, and other credential systems.
- The workflow is designed to work without GitHub Actions.
- The public demo uses a mock provider so no real secret is ever exposed.

For live operation, the same provider boundary can be connected to a disposable GitHub sandbox, a least-privilege GitHub App, Smee, and local
HashiCorp Vault.

## How Codex and GPT-5.6 were used

I used Codex throughout the development process to:

- Convert the incident-response idea into an implementable workflow
- Design the provider adapter boundaries
- Build the webhook and rotation contracts
- Generate regression tests
- Debug state persistence in the deployed Worker
- Create the judge-facing demo path
- Review security boundaries and documentation
- Produce and validate the final submission video

GPT-5.6 helped turn the response process into a clear agent workflow with planner, executor, and critic responsibilities.

The runtime demo is intentionally deterministic and safe. GPT-5.6 and Codex were used meaningfully during the design, implementation, testing,
and verification process rather than being included only as labels.

## Challenges

The biggest challenge was balancing a convincing security demonstration with safe handling of credentials.

A demo that uses real production keys is unsafe. However, a static mockup does not prove that the workflow works.

The solution was to separate the system into two boundaries:

- A public, judge-visible demo using synthetic data and a mock provider
- A disposable live-sandbox path for testing real provider rotation without production credentials

Another challenge was operating without GitHub Actions. The workflow therefore accepts signed webhooks directly and runs on a public
Cloudflare Worker, avoiding CI-minute limitations.

## What I learned

I learned that automated secret rotation is not just a credential-management problem. It is a coordination problem involving:

- Event authenticity
- Provider-specific permissions
- Secret storage
- Deployment timing
- Health checks
- Rollback behavior
- Evidence sanitization
- Human-readable incident reporting

The most important design decision was to make revocation a guarded action instead of the first action. A replacement credential must be
proven healthy before the exposed credential is revoked.

## Future work

The next step is to add more disposable live-sandbox adapters for providers such as:

- GitHub App installation tokens
- Vercel project tokens
- Stripe test-mode keys
- HashiCorp Vault KV v2
- Cloudflare API tokens

Production integrations would also add approval policies, provider-specific rollback, rate limits, audit retention, and stronger
observability.

## Safety statement

This project does not contain production API keys, AWS access keys, Vault tokens, webhook secrets, or private credentials.

The public demo uses synthetic fixtures and mock provider behavior by design.

Built With

  • agentic
  • api
  • apps
  • automation
  • cloudflare
  • codex
  • credential
  • devsecops
  • github
  • gpt-5.6
  • hashicorp
  • incident
  • management
  • multi-agent
  • remotion
  • response
  • rotation
  • security
  • supertonic
  • typescript
  • vault
  • vercel
  • webhooks
  • workers
  • workflow
Share this project:

Updates