What we investigate
Treat a leaked key as an access-control incident. Establish its provider, projects, permitted operations, dependencies and observed use. Cost spikes alone do not establish the cause.
Response work to agree
- Preserve relevant access, usage and billing evidence through authorised administrators.
- Identify applications and deployment systems that depend on the credential.
- Coordinate revocation or restriction, replacement and downstream secret updates with service owners.
- Review persistent sessions, other credentials, exposed repositories and resource access where relevant.
What safe recovery requires
Never send an API key through the enquiry form. The team needs a non-sensitive description first and will agree a secure evidence channel after scope and access are authorised.
Start with a non-sensitive brief
Use the incident brief builder or contact the team. Describe the affected service, observed impact and whether activity is ongoing. Availability, authority and delivery scope are confirmed before response begins.
Turn observations into investigation questions
| Observation | Evidence to seek | Decision to resolve |
|---|---|---|
| A key appeared in a repository or log | Exposure location, time window and credential identifier | Who could access it, and what did it permit? |
| Usage or spend rose unexpectedly | Project usage, deployment changes and billing records | Was this expected demand, a fault or unauthorised use? |
| Revocation interrupted a production service | Dependency inventory and secret deployment history | Which owners must coordinate a replacement? |
Verify more than key rotation
Confirm that the compromised credential no longer works, that replacement secrets reached approved dependencies and that the original exposure path is closed. Review accessible resources and actions within the key’s scope. Billing evidence can help bound usage but is not a complete record of data access or disclosure.
What we agree to deliver
The scope identifies the questions to answer, records available, customer owners and permitted changes. Typical outputs include an event timeline, the affected boundary, approved containment actions, recovery checks and unresolved risks. The deliverables page explains how findings connect to evidence.
Continue with scoping investigation cost, or compare response engagement options.
