Leaked Pulumi API Token: what to do in the first hour

• Environment files committed by accident. A PULUMI_ACCESS_TOKEN= line in a .env file, a Docker Compose file or a shell profile that was checked into a repository.
• CI configuration. A token written into a pipeline definition as plain text instead of a secret reference, so it sits in the repository and in every fork.
• Build logs. A deploy step that prints its environment, or a verbose flag that echoes the arguments of the Pulumi CLI.
• Local backups and snippets. A copy saved in a notes file, a shared gist or a support thread while someone was debugging a deployment.
• Example projects. A tutorial or starter repository that was published with a real token by mistake, then reused by others.

1. Delete the exposed token first. In Pulumi Cloud, open your personal access tokens and delete the one that leaked. Deleting a token revokes its access immediately, so do it before you clean anything else.
2. Create a replacement for the pipelines or people that depended on it. Give it an expiry date, and prefer an organization or team token scoped to what the job needs over a personal token that can do everything its owner can.
3. Deploy the replacement to the CI system or the machine that runs pulumi up, then run a preview to confirm it can still read the stacks it needs.
4. Check the stack history. Review the update history of each stack for the period since the exposure. Look for deployments you did not start, resources created in regions you do not use, and changes to access, IAM roles or security groups. Pulumi keeps a record of updates, so compare it with what your pipelines expected to run.
5. Rotate the cloud credentials the stacks use. A Pulumi token does not reveal provider keys, but a token with deploy rights can change the infrastructure those keys control. If an attacker made a change, rotate the keys that the change could have exposed, such as service account keys, database passwords and secrets in the stack configuration.
6. Review stack secrets. Stack configuration can contain encrypted secrets. Check whether the passphrase or the key used to encrypt them was stored in the same repository, and rotate it if so.
7. Clean the repository and look for other credentials next to the token. See I accidentally pushed an API key to GitHub and Deep scan your whole git history.

Not sure what else leaked? Run a free scan.

Personal access tokens are listed under your user menu in Pulumi Cloud. Open the list, find the token by its description or creation date, and delete it from the menu at the end of its row. Organization and team tokens are managed from the settings of the organization or team that owns them, so if the leaked value was one of those, revoke it there. Pulumi’s documentation describes these steps in more detail, and the interface may change, so if a menu differs, look for the access token section of your account or organization settings and follow Pulumi’s current guidance.

The rule is called Pulumi API Token. It looks for the literal prefix pul- followed by exactly 40 lowercase hexadecimal characters, with a word boundary before it and a boundary after the value, such as a quote, a space, a semicolon or the end of the line. A value that is shorter or longer than 40 characters is not reported. The severity is high. This type is not checked live: LeakWatch does not send any request to Pulumi with the token it found, so the detection is the only signal, and you should revoke the token yourself.