A credential leaked

Runbook for your leaked machine or person credential: revoke, read the audit log, rotate what it could read, close the hole.

Revoke first, investigate second.

Procedure

Revoke

Open Machine Identities then All Identities, open the identity, and revoke the credential row. Revoke the whole identity when you cannot tell which credential leaked.

Revoked	What stops	Reversible
One credential	That credential	Yes: issue the identity a new one
The identity	Every credential it holds; we delete its grants	No
A cloned keypair	The keypair and every credential it minted	No: enroll a new key

Both revocations need machine:revoke at the environment the identity is bound to. We email the members chosen for security alerts (alerts). See revoking.

For a person's pcu_ credential, that person runs:

penv logout

penv logout revokes it. Unrevoked, a pcu_ lasts 30 days from its last use, and at most 90 days. A password reset or Sign out everywhere under Settings > Security revokes every one you hold.

An exchanged credential lives fifteen minutes. One leaked in an older build log is already dead; rotate your values instead.

Confirm the revocation

Filter the audit log for credential.revoke or identity.revoke under your name.

Read the log

Filter by the identity over the whole life of the credential. Browsing needs audit:read; exporting needs audit:export.

Action	Records
`secret.read`	Every value opened, with the address and the identity
`secret.reveal`	A value released to an agent session, naming the approver
`credential.cloned`	A bound keypair used from two hosts; the console shows both counters
`credential.drifted`	A trust stopped matching, usually a renamed or moved repository

The actor on a machine entry is the identity; the credential sits in the entry's metadata. A read with a credential from the published action also stamps the run: repository, workflow ref, executing job's workflow ref, run id, run attempt, platform actor.

You read the run stamp and the credential.cloned counters in the console, even when you stream the log elsewhere. See the audit log.

Rotate every value it could reach

A machine credential is bound to one project and one environment: rotate every key there, oldest and most sensitive first. See rotate a value. We keep every version, so rotating destroys no evidence.

Restart readers

Redeploy or restart everything that read those values, so none of your processes holds the old ones.

Retire the old values

Revoke the old values at the provider that issued them.

Close the hole

Where it leaked	Cause
A build log	Output masking cannot cover
A laptop	A person held a credential a machine should hold
A repository	No trust was set up for that machine

A co-located step in the same CI job reads anything the job holds. See values in a CI build.

Fix the channel, issue a new credential, confirm the pipeline is green.

Cloned keypair

When the generation counters disagree, we revoke the keypair and every credential it minted, write credential.cloned with both numbers, and email the members chosen for security alerts (alerts). The host prints:

{
  "error": "cloned",
  "message": "this machine's identity was used from a second machine, so the server locked it.",
  "fix": "Create a new enrolment secret in the console, then run penv machine enroll <secret>."
}

You have nothing left to revoke. Find where the key was copied, then enroll a new key with penv machine enroll.

Refusal	Meaning	Revoked
`cloned`	The key was used from a second host	The keypair and its credentials
`unauthorized`	A replay of a request that already succeeded; not a copy	Nothing

A host that proves nothing covers bound keypairs and penv machine.

Stream the audit log

On this page