What to Do After a Claude API Key Leak: A Seven-Step Response Checklist
GitHub added detection for anthropic_service_api_key and anthropic_user_api_key on October 13, 2026 and included both patterns in push protection by default for repositories with secret scanning enabled, including free public repositories. Prevention does not replace incident response. Anthropic recommends immediately revoking a suspected compromised key in Claude Console, using environment variables or encrypted secret storage, separating keys by environment and purpose, rotating keys, and scanning repositories. This durable seven-step checklist covers the full response: stop the affected workload, revoke the key, review usage and billing evidence, remove exposed copies from code and logs, issue a narrowly scoped replacement, redeploy and verify, then document the cause and add preventive controls. Never paste a real key into chat, screenshots, tickets, or public cleanup requests.

