# Leaked Vault Service Token? Revoke It and Audit Access > HashiCorp Vault token exposed? Revoke it with the CLI or API, review the audit log and leases, and rotate the secrets it could read. Guide. Source: https://leakwatch.net/secrets/vault-service-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Vault Service Token Databases & keys · Secret guide # Leaked Vault Service Token: what to do in the first hour Critical severityDetected onlyLast verified October 19, 2026 · 4 min read A Vault service token is the credential a client presents to HashiCorp Vault after authenticating. It carries the policies attached to it, so whoever holds it can read, write or delete whatever those policies allow: database passwords, cloud keys, certificates and encryption operations. Vault is where other secrets live, so a leaked token can expose many of them at once. Revoke it first, then read the audit log. [Check your GitHub account for leaked secrets — free](/) Provider Vault Severity Critical Impact Cloud infrastructure access Checked live by LeakWatch No ## What a Vault service token looks like Current Vault service tokens start with `hvs.`, followed by a long string of letters, digits, dashes and underscores. Older versions issued shorter tokens beginning with `s.`: ```text hvs.…XXXX Vault service token, current format (masked, 90 to 120 characters after the prefix) s.…XXXX Vault service token, legacy format (masked, 24 characters after the prefix) ``` The `hvs.` form is easy to attribute. The legacy `s.` form is short and generic, so it is far more likely to match by accident. The variable name usually helps: `VAULT_TOKEN`, an `X-Vault-Token` header, or a call to a `/v1/` path on your Vault address. Batch tokens (`hvb.`) and recovery tokens are different kinds and are covered separately. ## How Vault service tokens get leaked - **Environment files.** `VAULT_TOKEN` exported in a `.env` file or a shell script and committed. - **The token helper file.** The `~/.vault-token` file that the CLI writes after login, copied into a repository, an image or a backup. - **CI pipelines.** A root or long-lived token placed in a workflow file instead of using a short-lived authentication method. - **Logs and traces.** A verbose client printing request headers, or an application logging its configuration. - **Documentation.** A real token pasted into a runbook, a ticket or a chat to demonstrate a command. ## What to do in the first hour 1. **Identify the token.** If you know the token, look it up with `vault token lookup` to see its policies, creation time and expiry. If you have only its accessor, `vault token lookup -accessor` gives the same details without the secret. 2. **Revoke it now.** Use `vault token revoke`, or revoke by accessor with `vault token revoke -accessor`. Revoking a token also revokes the child tokens and leases it created. If the token is a root token, generate a new one only when you need it and revoke it after use. 3. **Review the audit log.** If an audit device is enabled, search it for requests made with the token’s accessor: which paths it read, which it wrote, and from which addresses. 4. **Rotate what it could read.** List the policies on the token and the secrets they cover. Rotate each static secret, database credential and key at its source, and revoke dynamic leases if needed. 5. **Check Vault configuration.** Look for new auth methods, new policies, new tokens with long lifetimes, and changed audit devices. 6. **Use short-lived access.** Prefer authentication methods that issue tokens with a short time to live, and keep policies narrow. 7. **Check the repository.** See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). Not sure what else leaked from the same repository? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at HashiCorp Vault There is no central provider console: revocation happens on your own Vault server. Use the command line or the HTTP API against your Vault address with a token that is allowed to revoke tokens, and revoke the exposed one directly or through its accessor. Vault’s documentation describes token revocation and the effect on child tokens. If you run HCP Vault, use its cluster interface or the same commands against the cluster address. If the token already expired, the leak is closed, but still review the audit log for what happened before expiry. ## How LeakWatch detects it The rule is called Vault Service Token. It matches `hvs.` followed by 90 to 120 characters of the token alphabet, or the legacy `s.` followed by exactly 24 letters and digits, bounded by a quote, a space, a line end or a semicolon. The legacy form is short and can match unrelated strings. The severity is **critical**. **This type is not checked live**: LeakWatch never contacts your Vault, which is normally on a private network, so a finding means the string was seen, not that the token is valid. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Is a short s. string always a Vault token? No. It is a legacy format and also a common shape for other identifiers. Check whether a Vault address or `VAULT_TOKEN` appears nearby. Does revoking the token also revoke what it created? Yes. Revoking a token revokes its child tokens and the leases issued under it, which is usually what you want after a leak. The token has a short lifetime. Do I still need to act? If it has already expired, you need not revoke it, but you must read the audit log for use during its lifetime and rotate any secret it read. ## Related - [Terraform Cloud API Token](/secrets/terraform-cloud-api-token) - [Database Connection String](/secrets/database-connection-string) - [AWS access key](/secrets/aws-access-key) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Vault. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)