I leaked my MongoDB password, so I built a tool that rotates it with zero downtime

说明与用途

作者不小心将包含 MongoDB 密码和 JWT 秘钥的 .env 文件推送到公共仓库。他创建了 leakfix 工具，能够安全地无停机地轮换这些秘密，并在任何步骤失败时自动回滚。

问题

A .env file containing MongoDB credentials and JWT secrets was pushed to a public GitHub repository, exposing secrets that bots could scrape and use.

结果

After implementing leakfix, the author successfully rotated MongoDB and JWT secrets with zero downtime, automatically rolling back if any step failed.

工作流

• 1. Create a new credential next to the leaked one (both work)
• 2. Switch the deployment’s environment variables to the new value
• 3. Redeploy production once for all changed variables
• 4. Verify by calling a health route that fails if the database is unreachable
• 5. Revoke/delete the leaked credential

证据

I pushed a .env file to a public GitHub repo. It held the MongoDB password and the JWT secrets of Collabify, a real‑time Kanban app I run on Vercel.

来源

The only real fix is to rotate: replace each secret so the leaked one stops working.

来源

Until step 5, everything can be undone. If any step fails, the completed steps are undone in reverse: variables get their old values back, production is redeployed on the old config, and the new credential is deleted.

来源

After fixing both, the third run rotated everything with zero downtime.

来源