Cloudflare API token leak + rotation (2026-07-06)

runbook Mon Jul 06 2026 00:00:00 GMT+0000 (Coordinated Universal Time) securityincidentcloudflaresecretsrotation

CF API token leak + rotation — 2026-07-06

Incident

Token cfut_REDACTED_LEAKED_TOKEN hardcoded at scripts/cf_cleanup.py:13. Pushed to public workspace. Scrubbed to env var read (os.environ["CF_API_TOKEN"]).

Token ID: 5ccddd54b26ac5e5d8bcb0c5747d44a8.

Status at rotation time

• File cleaned: yes (scripts/cf_cleanup.py:14 reads env).
• No other files in workspace contain the token (grep -r confirmed).
• Token still active on Cloudflare as of 2026-07-06 (verify endpoint returned active).

Rotation steps (user action required)

1. Open https://dash.cloudflare.com/profile/api-tokens
2. Find token id 5ccddd54b26ac5e5d8bcb0c5747d44a8 (or by prefix — recover from prior git-history commit 259e164).
3. Click Roll (rotate) or Delete.
4. Create replacement token with same permissions (Pages + DNS edit for oriz.in).
5. Update .env.enc with new token, re-encrypt, push.
6. sops -d .env.enc > .env locally to refresh.

Prevention

• Pre-commit hook: gitleaks or trufflehog scanning for cfut_* pattern.
• Rule rules/security/no-hardcoded-secrets — all secrets via sops+age.
• Never os.environ.get("TOKEN", "<default>") with a real fallback.

Git history purge (if needed)

Public workspace commit still carries the token in history. Options:

• git filter-repo --replace-text to redact.
• bfg --replace-text alternative.
• Assume compromised regardless — rotate is the only real fix.