I leaked my MongoDB password, so I built a tool that rotates it with zero downtime

Description and use

The author accidentally pushed a .env file with MongoDB and JWT secrets to a public repo. He built leakfix, a tool that safely rotates these secrets with zero downtime, automatically rolling back if any step fails.

Problem

A .env file containing MongoDB credentials and JWT secrets was pushed to a public GitHub repository, exposing secrets that bots could scrape and use.

Outcome

After implementing leakfix, the author successfully rotated MongoDB and JWT secrets with zero downtime, automatically rolling back if any step failed.

Workflow

• 1. Create a new credential next to the leaked one (both work)
• 2. Switch the deployment’s environment variables to the new value
• 3. Redeploy production once for all changed variables
• 4. Verify by calling a health route that fails if the database is unreachable
• 5. Revoke/delete the leaked credential

Evidence

I pushed a .env file to a public GitHub repo. It held the MongoDB password and the JWT secrets of Collabify, a real‑time Kanban app I run on Vercel.

Source

The only real fix is to rotate: replace each secret so the leaked one stops working.

Source

Until step 5, everything can be undone. If any step fails, the completed steps are undone in reverse: variables get their old values back, production is redeployed on the old config, and the new credential is deleted.

Source

After fixing both, the third run rotated everything with zero downtime.

Source