Leaked API keys

The short version

Smarter Weather is a partner in GitHub’s secret scanning program. When GitHub finds a string with the live key shape sw_live_ (43 base64url characters) in a public repository, gist, or issue, it sends us a signed report.

We check the signature and revoke the key automatically, with no person in the loop. The revocation is recorded in your account’s audit log.

If your key leaked, create a replacement in the dashboard and update your application. A revoked key cannot be restored.

What happens, step by step

1. GitHub finds the key. GitHub scans public repositories, gists, and issues. When a string matches the sw_live_ pattern, GitHub sends it to us in a report signed with ECDSA P-256.
2. We verify the report. The report arrives at a public endpoint that accepts only a valid signature, checked against GitHub’s published public keys. Anything that fails the check is rejected.
3. We revoke the key. New requests with the key are rejected within 60 seconds. Requests already in progress finish normally.
4. We record it. Your audit log gets an entry with command = "auto-revoke" and adminEmail = "system:github-secret-scanning", in the same shape as a revocation made by a person.
5. You create a replacement. Requests with the revoked key now get a 401. Check your keys in the dashboard and create a new one.

Create a replacement key

A revoked key cannot be restored. Create a new one and update your application:

1. Open the API keys page in the dashboard.
2. Click Create key, give it a name that tells it apart from the leaked key (for example the date or the reason), and copy it. The dashboard shows the full key only once.
3. Put the new key in your environment or secret store, never in source control, and restart the services that use it.
4. Send a test request from your application to confirm the new key works. Its traffic shows in the dashboard’s usage view.

On an Enterprise contract, email developers@smarterweather.com and we can rotate the key for you.

Prevent leaks

Secret scanning is a backstop. Do not rely on it to catch a leak.

• Never commit keys to source control. Use environment variables, your CI provider’s secret store, or a secret manager such as AWS Secrets Manager, Doppler, or 1Password Secrets Automation.
• Use sw_test_ keys for development. Test keys are never billed. Their prefix is different, so GitHub’s scanner does not match them, and a leaked test key is not revoked automatically.
• Add a pre-commit hook for sw_live_. Tools such as gitleaks can fail any commit that contains the live key prefix.
• Rotate keys on a schedule. Rotation limits the damage from a leak you have not found yet. Pair it with a deploy.

Report a leak we missed

GitHub’s secret scanning covers public repositories, gists, and issues on github.com. It does not cover private repositories, paste sites, chat apps, or anywhere else a key can end up. If you find a Smarter Weather API key exposed anywhere:

• If it’s your own key: revoke it on the API keys page now and create a replacement. You don’t need to contact us.
• If it’s someone else’s key: email security@smarterweather.com with where you found it. We revoke the key on the owner’s behalf. Send a link to the leak, not the key itself.

We do not run a public bug bounty program. We credit responsible disclosures in our changelog when the reporter wants to be named.

Technical references

For partners who want the protocol details. You do not need them to use the API.

• GitHub’s documentation: Secret scanning partner program. The live key pattern is sw_live_[A-Za-z0-9_-]{43}.
• The signature is ECDSA P-256 over the raw request body, checked against the public keys GitHub publishes at api.github.com/meta/public_keys/secret_scanning.

Questions about this page? Email security@smarterweather.com.