Leaked CircleCI Personal Access Token: what to do in the first hour

• Local tooling configuration. The CircleCI command-line tool or a script stores the token in a file that gets committed with the rest of the project.
• Pipeline definitions. A token pasted into a configuration file as a variable, instead of being set in the project’s environment settings.
• Scripts that call the API. A deployment or reporting script that carries the token inline and is then shared with a team.
• Logs and screenshots. A command that echoes the token, or a settings page captured with the value visible.
• Shared dotfiles. A personal configuration repository that keeps working credentials alongside harmless settings.

1. Delete the exposed token. Open your user settings in CircleCI, go to the personal API tokens section, and remove the token that matches the leaked value. Deleting it ends its access at once, so do it before any other cleanup.
2. Create a replacement if your scripts or tools still need one. Give it a name that says where it is used, and set the shortest expiry date that still works. CircleCI requires an expiry date, which limits how long a leaked token can be abused.
3. Update the tools and pipelines that used the old token. Put the new value in the CircleCI project settings or your secret store rather than in a file.
4. Review pipeline activity. Look at the pipelines and workflows that ran in the organizations you belong to since the exposure. Look for runs you did not start, changes to configuration, and jobs that used unfamiliar branches or commit messages.
5. Check project and context settings. Review environment variables and contexts that the token could read, and rotate any secret that might have been displayed in a job log.
6. Review organization membership. Check who has access to the projects and remove anyone who no longer needs it.
7. Clean the repository. Remove the value from the file and rewrite history if you want to. See I accidentally pushed an API key to GitHub, and use deep-scan your whole git history to find older copies.

Not sure what else leaked? Run a free scan.

Open your personal API tokens page in CircleCI user settings. Find the token by its name, which is the label you gave it when you created it, and remove it with the delete control, then confirm. Tokens cannot be edited after they are created, so deleting and creating a new one is the only way to rotate. Tokens issued through an OAuth sign-in flow appear in the same list, and you can delete them there too. Expiry reminder emails stop for a token once it is deleted.

The rule is called CircleCI Personal Access Token. It looks for the literal prefix CCIPAT_, then exactly twenty-two letters or digits, an underscore, and exactly forty hexadecimal characters, with a word boundary at each end. The prefix is matched in lower case as well. A value that is shorter, longer, or without the right underscore layout is not reported. The severity is high. This type is not checked live: LeakWatch does not call the CircleCI API with the value it found, so a finding tells you the value has the right form, not whether it still works.