# Exposed Secrets and Edge Device Response Kit

**Purpose.** Attackers are using automated, agentic tooling to find API keys, tokens and OAuth secrets left in code, config files and backups, and to exploit unpatched edge devices like VPN appliances. This kit lets a small business find its own exposed secrets first, rotate them in priority order, audit connected apps, check firewall and VPN patch status, and write a one-page incident plan. Print it, fill it in, and keep the filled copy somewhere safe (not in a repo). Never paste real secret values into any AI tool or into this document; record only where a secret lives and what it can do.

## Checklist

- [ ] Run gitleaks or trufflehog across every repository you own, including old branches and forks.
- [ ] Search shared drives, laptops and backup folders for `.env`, config, `.pem`, `.json` credential and `.bak` files.
- [ ] Turn on GitHub secret scanning and push protection for every repo, if your plan includes them.
- [ ] Fill in the secrets inventory worksheet below and score each secret's blast radius.
- [ ] Rotate secrets in order of blast radius (money movement, customer data, email sending, admin access) and revoke the old keys, not just replace them.
- [ ] Test each live integration after rotating (a small test payment, a test sync, a test email).
- [ ] Audit OAuth grants in Google Workspace, Microsoft 365, Shopify, Slack and every AI tool; remove unused apps and narrow scopes.
- [ ] List every firewall, VPN and router; check firmware against the vendor advisory and CISA's known-exploited list.
- [ ] Patch SonicWall SSL-VPN (if you run one) and confirm MFA actually prompts at login.
- [ ] Move remaining secrets into a password manager or secrets store; remove them from code.
- [ ] Tell your bank and payment processor which keys you rotated; ask what out-of-band confirmation they require for new payees.
- [ ] Write and share the one-page incident plan below.
- [ ] Put a quarterly rotation reminder and a monthly 30-minute review on the calendar.

## Worksheet 1: Secrets inventory

Copy this table, one row per secret. Never write the secret value itself.

| Service | Key purpose | Owner | Where it lives | Blast radius (1 to 5) | Last rotated | Revoked old key? |
|---|---|---|---|---|---|---|
| e.g. Stripe | Restricted key for invoices | Finance lead | Old repo, config.js | 5 (moves money) | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |

Blast radius guide: 5 moves money or admin access; 4 reads customer data; 3 sends email or messages as you; 2 reads internal data only; 1 test or sandbox key.

## Worksheet 2: Rotation order

Rotate all 5s first, then 4s, then 3s. For each: create the new key, update the live integration, test it, revoke the old key, record the date.

- 5s done on: ______________
- 4s done on: ______________
- 3s done on: ______________
- 2s and 1s done on: ______________

## Worksheet 3: Free scan commands

Run these from a terminal on a machine that has your repos checked out. Both tools are free and open source. Check each tool's own documentation for current options.

```text
# gitleaks: scan a repo including its full git history
gitleaks detect --source . --log-opts="--all" --redact --report-format json --report-path gitleaks-report.json

# trufflehog: scan a local git repo, showing only results that still verify as live
trufflehog git file://. --only-verified

# plain folder search for risky file names (macOS/Linux)
find . -type f \( -name ".env*" -o -name "*.pem" -o -name "*.bak" -o -name "*credentials*" \) 2>/dev/null
```

The `--redact` flag keeps secret values out of the report. Treat any "verified" finding as live and rotate it today.

## Worksheet 4: OAuth grant audit

| Platform | App or connector | Last used | Scopes granted | Keep / narrow / remove | Done |
|---|---|---|---|---|---|
| Google Workspace | | | | | |
| Microsoft 365 | | | | | |
| Shopify | | | | | |
| Slack | | | | | |
| AI tools (chat, automation) | | | | | |

Rule of thumb: if nobody can say who added it and why, remove it. If the scope is broader than the job (full Drive access to read one folder), narrow it.

## Worksheet 5: Edge device patch tracker

| Device | Model | Firmware version | Advisory checked (date) | On CISA known-exploited list? | MFA confirmed enforcing? | Patch date | Rollback plan noted? |
|---|---|---|---|---|---|---|---|
| e.g. VPN appliance | SonicWall SSL-VPN | | | | | | |
| | | | | | | | |
| | | | | | | | |

## Worksheet 6: One-page incident plan

- Who can revoke keys and where (names and the admin consoles): ______________
- Who calls the bank and processor, and the phone numbers: ______________
- Who speaks to customers and what the first message says: ______________
- Where this plan is stored offline: ______________
- Date last reviewed: ______________

### Bank call script

```text
Hello, this is [name] from [business], account ending [last 4]. We found that an access credential for our payment integration may have been exposed. We have revoked it and issued a new one on [date]. Please (1) flag the account for unusual activity, (2) tell me what out-of-band confirmation you require before a new payee or changed payment details are accepted, and (3) tell me the fastest way to reach your fraud team if we see something suspicious.
```

## Worksheet 7: 30-minute monthly review

1. Re-run the secret scan on repos changed this month (5 minutes).
2. Check OAuth grants for anything new (5 minutes).
3. Check vendor advisories and CISA's known-exploited list for your edge devices (10 minutes).
4. Confirm anyone who left the business no longer holds keys or app access (5 minutes).
5. Update the inventory and note the date (5 minutes).

## AI prompts

Paste your own redacted data. Never paste real secret values.

```text
I run a [type] business with about [number] employees using [list of tools: GitHub, Stripe, QuickBooks, Shopify, Google Workspace]. Build me a prioritized checklist for finding exposed API keys and OAuth secrets, ranked by how much damage each type could do, with the exact order to rotate them. Base it only on the tools I listed. If you're unsure how a specific service handles key revocation, say so and tell me where to check its documentation.
```

```text
Here is the output of a gitleaks scan with the secret values redacted: [paste]. Group the findings by service, tell me which are most dangerous, and give me step-by-step rotation instructions for each service without breaking my live integrations. Work only from the findings I pasted. If a finding is ambiguous or you can't tell what service it belongs to, say so instead of guessing.
```

```text
Explain in plain English how an AI agent could take a leaked OAuth token and turn it into access to my accounts, and list 8 specific controls (scopes, expiry, IP restrictions, alerts) a non-technical owner can set this week. Here are the apps I have connected, copied from my own admin console: [paste list]. Tailor the controls to those apps, and flag any control you're not certain exists for a given app.
```

```text
I have a SonicWall firewall with SSL-VPN. Here is my current firmware version and model from the admin page: [paste]. Give me a safe step-by-step plan to check that version against the vendor advisory, verify MFA is enforced, apply the vendor patch, and roll back if something breaks, written for an owner working with a part-time IT contractor. Tell me which steps you can't verify without the vendor's current advisory so I look those up myself.
```

```text
Draft a one-page secrets-and-access policy for a [size] business using these tools: [list]. Cover where secrets may live, who can create them, how often they rotate, what to do when one leaks, and a 30-minute monthly review routine. Use only the tools and roles I've described, and mark any section where you had to assume something so I can correct it.
```

## Sources

- https://apprised.news/desk/tech/2026-11-07
- https://apprised.news/desk/tech/2026-11-06
- https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
- https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
- https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/
- https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
- https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more
- https://www.csoonline.com/article/4245407/openssh-flaw-lets-attackers-access-password-disabled-accounts-on-some-linux-systems.html
- https://www.securityweek.com/3-charged-in-scheme-to-use-ai-to-impersonate-ceos-and-attorneys-to-steal-129-million/
- https://community.openai.com/t/security-follow-up-tool-call-silently-routed-to-a-different-connector/1413053