From 5ecb6609b292c48b06a620a2db887cf269700b95 Mon Sep 17 00:00:00 2001
From: Teesofttech <tundeesanju@gmail.com>
Date: Sat, 18 Jul 2026 14:38:16 +0100
Subject: [PATCH] Add credential incident safeguards and purge runbook

---
 docs/credential-rotation-and-history-purge.md | 62 +++++++++++++++++++
 docs/dependency-security.md                   |  4 ++
 2 files changed, 66 insertions(+)
 create mode 100644 docs/credential-rotation-and-history-purge.md

diff --git a/docs/credential-rotation-and-history-purge.md b/docs/credential-rotation-and-history-purge.md
new file mode 100644
index 0000000..a7cae74
--- /dev/null
+++ b/docs/credential-rotation-and-history-purge.md
@@ -0,0 +1,62 @@
+# Credential Rotation And History Purge
+
+This runbook is used for security incident response when credentials are
+accidentally committed to the repository.
+
+It covers issue #60: rotate exposed payment credentials and purge them from
+git history.
+
+## 1. Immediate containment
+
+1. Identify all exposed secrets and providers impacted.
+2. Rotate each credential in the provider dashboard.
+3. Revoke old credentials immediately after rollover validation.
+4. Update application secrets in secure stores only:
+   - production secret manager
+   - CI/CD protected secrets
+   - local `.NET user-secrets` for development
+5. Never place replacement credentials in repository files.
+
+## 2. Purge exposed values from git history
+
+Coordinate with maintainers before history rewrite. This operation changes
+commit SHAs and requires force-push.
+
+Create a replacement file, for example `replacements.txt`:
+
+```text
+literal:sk_live_abc123==>YOUR_STRIPE_SECRET_KEY
+regex:FLWSECK_(TEST|LIVE)-[A-Za-z0-9_-]+==>YOUR_FLUTTERWAVE_SECRET_KEY
+```
+
+Rewrite history with `git-filter-repo`:
+
+```bash
+pipx run git-filter-repo --replace-text replacements.txt
+```
+
+Then force-push safely:
+
+```bash
+git push --force-with-lease origin master
+git push --force-with-lease --all
+git push --force-with-lease --tags
+```
+
+## 3. Post-purge verification
+
+1. Re-clone repository in a fresh directory.
+2. Run secret scanning:
+
+```bash
+gitleaks dir . --redact --no-banner
+```
+
+3. Verify GitHub secret scanning and Dependabot alerts are clear.
+4. Confirm applications can authenticate with rotated credentials.
+
+## 4. Communication checklist
+
+1. Open incident update with impacted systems and rotation completion status.
+2. Ask all contributors to rebase or re-clone after history rewrite.
+3. Close the incident only after verification steps pass.
diff --git a/docs/dependency-security.md b/docs/dependency-security.md
index 5cf8131..456d27c 100644
--- a/docs/dependency-security.md
+++ b/docs/dependency-security.md
@@ -13,6 +13,10 @@ Run the same audit locally:
 ./scripts/check-vulnerable-packages.sh
 ```
 
+For credential exposure response (rotation + history rewrite), follow:
+
+- [Credential rotation and history purge](./credential-rotation-and-history-purge.md)
+
 ## July 2026 remediation
 
 The .NET 8 dependency graph previously resolved vulnerable transitive versions