1

This question already has an answer here:

Did something stupid, and asked a question on stackoverflow posted a little too much info without realizing it.

Is it a major security risk if your client_secret gets displayed for about 30 min - 1 hour on stack overflow before you notice it showing and you can remove it?

marked as duplicate by forest, Xander, MechMK1, multithr3at3d, Benoit Esnard Aug 14 at 14:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Remember, even if you remove it, it will still be visible in revision history. – forest Aug 14 at 1:24
  • Just deleted the whole question. Should that take care of the problem? – klj Aug 14 at 1:32
  • 2
    No. People with 10k reputation can still view it. – forest Aug 14 at 1:33
  • I'm afraid that Only your boss knows how your boss would respond. There are some idiotic ones out there that might hold things like this against someone. However, any half decent boss should take it in stride or at least get over it quickly. Accidents like this happen. The important part is how someone handles it next. Trying to fix it and notifying the right person is the correct move, and people who do that are the kind of people I like to work with. – Conor Mancone Aug 14 at 2:00
  • He does seem to be on the more reasonable side. But this is my first real programming job so I don't want to screw things up. – klj Aug 14 at 2:04
4

The only thing on Stack Overflow that might not be public forever is a comment. If you edit an answer or question all past versions are still available. Deleted questions and answers are still visible to mods as well as any user with enough rep. Even the chat sites retain permanent public transcripts. It's possible that you could have an admin actually remove something from the revision history, but I'm not 100% sure. In short, you should assume that anything you ever post to stackoverflow has permanently become public knowledge. So in this case, yes, change your client secret.

In general, if you were to post a secret to a public place for a brief period of time, only you can decide whether or not the "cost" of changing it outweighs the risk of someone using it. If the client secret protects something low-risk (imagine a Google maps API key that is only authorized for use from your server IP), then you may reasonably decide not to change it.

Personally though, unless the key is nearly impossible to change, I would change it no matter how short the exposure.

Not the answer you're looking for? Browse other questions tagged or ask your own question.