Committed an API Key to GitHub? What Else Did I Miss?

2026-10-28

The foils are cold on your scalp and the stylist has just said, "Twenty minutes, then we rinse."

You reach for your phone, because twenty minutes is twenty minutes. There is one new email. The subject line starts with the word Alert, and it is from GitHub.

Your stomach does something small and unpleasant.

A secret was detected in your repository. An API key. The one you pasted into a config file on Thursday, "just for now, to see if it works". The one you meant to move into an environment variable before the commit.

You did not move it before the commit.

The part that takes four minutes

Let's call you Mira. You build small web backends for two or three clients, mostly Node and Express, sometimes a bit of Python. You work alone. There is no security team, no colleague to say "oh, that happens to everyone".

Sitting in the chair with a cape over your shoulders, you do the quick part. You open the provider's dashboard on your phone, revoke the key and create a new one. The stylist politely pretends not to notice your face.

The key is dead. The alert is dealt with. Technically, the problem is over.

But your pulse has not caught up with that.

The question underneath the question

The leaked key was never the real worry. The real worry sits right behind it, and it is quieter:

If I did that, what else did I do?

Is there another secret in an old branch? Did the staging server ever get locked down properly? Does that one route you wrote in a hurry in March check who is calling it? Did you ever test what happens when someone sends it something strange?

You honestly don't know. That is the uncomfortable bit. You are not careless. You are careful in the places you remember to be careful. The gaps are exactly the places you forgot, and by definition you don't remember them.

So the mind starts scrolling through the project like a hallway of closed doors, trying handles at random.

What it quietly costs

Nobody puts this on an invoice, but it has a price.

It is the half-attention you give the client call at two o'clock, because part of you is still checking the repo in your head. It is the Saturday walk where you almost turn back to open the laptop. It is the slightly too vague answer when a client asks, "Is the API secure?" and you hear yourself say, "Yes, I think so."

I think so. Two words that make a professional feel like someone winging it.

You rinse. You dry. You pay. You sit in the car outside with the engine off and the phone in your hand, and you do not drive for a minute.

The turning point is smaller than you expect

Here is what changes things, and it is not a heroic weekend of auditing.

It is realising that you have been trying to answer "what did I miss?" from memory. Memory is the one tool that already failed you on Thursday.

The answer was never going to be a bigger worry. It is a list. A plain, finite, written-down list that someone sensible has already thought through, so you are not inventing your own paranoia at 2 a.m. You go through it item by item, tick what is fine, note what isn't, and at the end you know. Not "I think so". Know.

The unknown stops being a hallway of closed doors and becomes a page with a number at the bottom.

A different Monday

Picture the same week, with that list in your hands.

It is Monday, around ten. Coffee is still warm. You open a single tracker, and most of the rows already have a calm little tick. Two are marked to fix. One of them is the route from March, and it takes you forty minutes, not a lost weekend. You were going to fix it anyway. Now you know it exists.

The leaked key still happened. It is a tiny line in your notes now: rotated, checked, done. It is no longer a verdict on you as a developer.

Then the client calls and asks the old question: "Is the API secure?"

You can say, evenly, "I've been through a full review. Here's what I checked, and here's the short report." There is no pause where the doubt used to be. You sound like what you actually are, a professional who looks after their work.

Afterwards you close the laptop at six. The evening is yours.

If you recognise yourself

That feeling, of fixing the visible thing and still wondering about the invisible ones, is exactly what we had in mind when we put together the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit. It is a 58-item review for Node/Express and Python APIs, with a PDF, an XLSX tracker, curl tests, a script that scans your auth routes, and a client report template. You work through it at your own pace and finish with a clear picture instead of a hunch.

It is a tool for organising your review. It does not replace a professional security audit when your project calls for one. It is covered by a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

If this story felt a bit too familiar, you can take a look at the kit here.

And whatever you decide, the key is already revoked. That was the hard part. The rest can be calm.

An illustrative story, written with AI assistance.