Leaked Vault Service Token: what to do in the first hour

• Environment files. VAULT_TOKEN exported in a .env file or a shell script and committed.
• The token helper file. The ~/.vault-token file that the CLI writes after login, copied into a repository, an image or a backup.
• CI pipelines. A root or long-lived token placed in a workflow file instead of using a short-lived authentication method.
• Logs and traces. A verbose client printing request headers, or an application logging its configuration.
• Documentation. A real token pasted into a runbook, a ticket or a chat to demonstrate a command.

1. Identify the token. If you know the token, look it up with vault token lookup to see its policies, creation time and expiry. If you have only its accessor, vault token lookup -accessor gives the same details without the secret.
2. Revoke it now. Use vault token revoke, or revoke by accessor with vault token revoke -accessor. Revoking a token also revokes the child tokens and leases it created. If the token is a root token, generate a new one only when you need it and revoke it after use.
3. Review the audit log. If an audit device is enabled, search it for requests made with the token’s accessor: which paths it read, which it wrote, and from which addresses.
4. Rotate what it could read. List the policies on the token and the secrets they cover. Rotate each static secret, database credential and key at its source, and revoke dynamic leases if needed.
5. Check Vault configuration. Look for new auth methods, new policies, new tokens with long lifetimes, and changed audit devices.
6. Use short-lived access. Prefer authentication methods that issue tokens with a short time to live, and keep policies narrow.
7. Check the repository. See I accidentally pushed an API key to GitHub.

Not sure what else leaked from the same repository? Run a free scan.

There is no central provider console: revocation happens on your own Vault server. Use the command line or the HTTP API against your Vault address with a token that is allowed to revoke tokens, and revoke the exposed one directly or through its accessor. Vault’s documentation describes token revocation and the effect on child tokens. If you run HCP Vault, use its cluster interface or the same commands against the cluster address. If the token already expired, the leak is closed, but still review the audit log for what happened before expiry.

The rule is called Vault Service Token. It matches hvs. followed by 90 to 120 characters of the token alphabet, or the legacy s. followed by exactly 24 letters and digits, bounded by a quote, a space, a line end or a semicolon. The legacy form is short and can match unrelated strings. The severity is critical. This type is not checked live: LeakWatch never contacts your Vault, which is normally on a private network, so a finding means the string was seen, not that the token is valid.