How to use this checklist
This is not a review you schedule. It is the list you open when a scanner fires, when a colleague says the word committed, or when somebody finds a token in a build log. The order is the point: the first item is the only action that reduces what an attacker can do, and every item beneath it is either evidence gathering or tidying. Work down the list rather than across it.
The strong temptation at the start of a leak is to make the value disappear, because deleting a file feels like undoing the mistake. It is not. A credential is worth exactly what its issuer will accept, and the issuer has no idea where the copies are. A password printed into a build log authenticates just as well after the log is deleted, and the minutes spent deleting it are minutes during which the credential was live.
Where the numbers come from
The exposure window opens at the author date of the change that introduced the value, found with a search across every reference rather than across the current branch, and closes at the moment the issuer stopped accepting the credential. What the credential did comes from the issuer audit records for that period. Who could have read it comes from access lists, fork lists and pipeline visibility settings as they stood during the window, not as they stand today.
Several items resist measurement entirely. Whether an artefact store or a log platform still holds a copy is often unanswerable without the platform owner. Whether a notification obligation applies is a judgement made by somebody with the authority to make it. Record those as decisions with a name attached, because a later review will ask who decided and on what basis.
Access this needs
Authority to revoke or replace the credential at its issuer, read access to the audit records for the exposure window, read access to the repository across all references and to its fork list, access to pipeline run history and artefact stores, and the ability to attempt authentication with the exposed value in order to confirm it has stopped working. The response also needs a place to write the incident record that is not the system under investigation.
What the review produces
An incident record containing the exposure window as two timestamps, the invalidation time and the evidence that it took effect, what the credential did according to the issuer, the population that could have read it, the list of siblings rotated, the artefacts and logs that still hold copies, the notification decision and its reasoning, and the tracked actions that follow. It is written as the response happens, not reconstructed afterwards from memory and channel scrollback.
Sign-off
- Reviewer: ________________ Date: ___________
- Platform owner: ___________ Date: ___________
- Security owner: ___________ Date: ___________
Every critical item must pass before the incident is closed. A failing critical item means the exposure is still open however tidy the repository now looks, and the credential must be treated as live until the item passes. Record the date, the reviewer, and the disposition of every item that did not pass.