Revoke the exposed private key

How to fix

1. 1 Revoke or reissue the certificate/key pair at its issuing authority (CA, SSH host, or signing system). A private key that was ever public should be treated as permanently compromised.
2. 2 Remove the key from the client bundle and keep private keys exclusively on the server or in a secret manager.
3. 3 Purge it from git history. A private key committed once remains recoverable from every prior commit.
4. 4 Redeploy and confirm the new build no longer ships the key file or its contents.

Common mistakes

• • Reissuing a certificate or key pair but continuing to trust the old one somewhere else (a second environment, an old load balancer config) that was not updated at the same time.
• • Removing the key file from the current deploy without purging it from git history, leaving it retrievable from any prior commit.
• • Treating a short exposure window ('it was only public for an hour') as low-risk: a private key can be copied and reused indefinitely once seen, so exposure time does not limit the damage.

How to verify

1. 1 Re-run the scan and confirm the private-key finding is gone.
2. 2 Grep the built/deployed JavaScript bundle and any static assets for a BEGIN PRIVATE KEY marker to confirm none remain.
3. 3 Confirm the reissued certificate or key is the one actually in use, rather than assuming the update propagated everywhere it needed to.

Related checks