Responsible disclosure when a scan finds a live credential

When a public-repository scan surfaces a credential that might still be live, the first duty is to avoid increasing exposure. Do not paste it into tickets, screenshots, chat, public issues, or a verification request. Do not use it to access the service.

Contain the evidence

Record the repository, commit, file location, detector, and minimal redacted context. Restrict access to the unredacted value. Remember that deleting the current file may not remove it from version history, caches, forks, or build artifacts.

Contact privately

Use the project's security policy, security advisory channel, or documented maintainer contact. Provide enough detail to locate and rotate the credential without reproducing it unnecessarily.

Remediate in the right order

Revoke or rotate first. Then remove the value from current source, assess history and logs, update dependent systems, and add a regression control. A source-code patch without revocation is not sufficient if the credential was usable.

Close and disclose carefully

Confirm receipt and remediation through the maintainer. If a public note is useful, wait until the credential is invalid and remove repository, path, provider, and value details that create fresh risk. The goal is durable learning, not proof that the scanner was right.

Verglos can surface a candidate secret. The human disclosure trail determines whether that detection helps or harms the affected project.