I leaked my MongoDB password, so I built a tool that rotates it with zero downtime

Описание и применение

Автор случайно опубликовал файл .env с паролем MongoDB и JWT‑секретами. Он создал инструмент leakfix, который безопасно меняет эти секреты, не прерывая работу приложения, автоматически откатывая изменения при ошибках.

Задача

A .env file containing MongoDB credentials and JWT secrets was pushed to a public GitHub repository, exposing secrets that bots could scrape and use.

Результат

After implementing leakfix, the author successfully rotated MongoDB and JWT secrets with zero downtime, automatically rolling back if any step failed.

Рабочий процесс

• 1. Create a new credential next to the leaked one (both work)
• 2. Switch the deployment’s environment variables to the new value
• 3. Redeploy production once for all changed variables
• 4. Verify by calling a health route that fails if the database is unreachable
• 5. Revoke/delete the leaked credential

Доказательства

I pushed a .env file to a public GitHub repo. It held the MongoDB password and the JWT secrets of Collabify, a real‑time Kanban app I run on Vercel.

Источник

The only real fix is to rotate: replace each secret so the leaked one stops working.

Источник

Until step 5, everything can be undone. If any step fails, the completed steps are undone in reverse: variables get their old values back, production is redeployed on the old config, and the new credential is deleted.

Источник

After fixing both, the third run rotated everything with zero downtime.

Источник