Leaked GitHub token: what to do in the next 10 minutes

Last updated: October 24, 2026. Steps checked against GitHub's own docs on October 24, 2026.

Short answer: Delete the leaked token in Settings → Developer settings → Personal access tokens. A token can do whatever you can do in the repos it covers, so act before you investigate.

Which GitHub keys are secret?

Secret: Personal access tokens: ghp_ (classic) and github_pat_ (fine-grained)
Secret: OAuth and GitHub App tokens (gho_, ghu_, ghs_, ghr_)
Meant to be public: None. GitHub says not to push tokens to any repository, even a private one.

The next 10 minutes

Times are a rough guide. Do the first step before anything else.

1. Delete the token (Minutes 0-2)

On GitHub: profile picture → Settings → Developer settings → Personal access tokens → Fine-grained tokens or Tokens (classic), then Delete next to the leaked token.
GitHub notes that deleting a token that was used to create a deploy key also deletes that deploy key.

2. Create a narrower replacement (Minutes 2-5)

Generate a new token, preferably a fine-grained one, with only the repositories and permissions you need and an expiration date.
Replace the old token everywhere it was stored, for example in GitHub Actions secrets or your host's environment variables.

3. Check what changed (Minutes 5-8)

Review your account's security log (Settings → Security log) for events you don't recognize.
In the repos the token could reach, look for unexpected commits, branches, deploy keys, webhooks and Actions workflow changes.

4. Clean up and prevent the next one (Minutes 8-10)

Remove the token from your code and history. Rotating is what protects you; cleaning history is the tidy-up.
Turn on secret scanning and push protection where available so GitHub can block future pushes that contain secrets.

Good to know

For Actions workflows, GitHub recommends the built-in GITHUB_TOKEN with minimal permissions instead of a personal access token.

After the first 10 minutes

Move the code that needs the key to the server (an API route, serverless function or Supabase Edge Function), keep the key in a server-only environment variable, redeploy, and re-check your live site. The general plan, with a prompt you can paste into Lovable, Bolt, Cursor or Claude Code, is in I leaked an API key in my vibe-coded app. What do I do now?

What SniffPup checks, and what it doesn't

A free SniffPup scan reads only what your live site serves to the public: secret key patterns in HTML and same-origin JavaScript (masked in the report) and public files such as /.env and /.git/config. It never uses a key it finds. It can't see your repo, your server or GitHub's logs, so the steps above are always on you. A clean report is not a guarantee of security.

Sources

GitHub can change its dashboard and steps at any time. If something here doesn't match what you see, follow GitHub's docs and tell us.

Other providers

Run a free scan →