Python Script to Rotate a Leaked API Key

#!/usr/bin/env python3
"""Checklist for rotating a leaked API key across a codebase."""

import re
from pathlib import Path


CHECKLIST = [
    "Identify all files containing the leaked key",
    "Generate a new key with sufficient entropy",
    "Update the secret storage/CI environment variables",
    "Replace the old key in every source file",
    "Test authentication with the new key",
    "Revoke the leaked key immediately after rotation",
    "Audit logs for any unauthorized use before rotation",
    "Rotate again if the leaked key was committed to git history",
]


def find_key_occurrences(directory: str, key: str) -> list[str]:
    """Return file paths that contain the given key."""
    matches = []
    pattern = re.compile(re.escape(key))
    for path in Path(directory).rglob("*"):
        if path.is_file() and not path.name.startswith("."):
            try:
                if pattern.search(path.read_text(errors="ignore")):
                    matches.append(str(path))
            except (OSError, UnicodeDecodeError):
                continue
    return matches


def rotate_key_in_file(filepath: str, old_key: str, new_key: str) -> bool:
    """Replace old_key with new_key in a single file."""
    path = Path(filepath)
    try:
        content = path.read_text(errors="strict")
    except (OSError, UnicodeDecodeError):
        return False

    if old_key not in content:
        return False

    path.write_text(content.replace(old_key, new_key))
    return True


if __name__ == "__main__":
    OLD_KEY = "sk-live-1234567890abcdef"
    NEW_KEY = "sk-live-abcdef1234567890"

    print("=== LEAKED KEY ROTATION CHECKLIST ===")
    for idx, item in enumerate(CHECKLIST, start=1):
        print(f"{idx}. {item}")

    print("\n=== DEMO: Scanning current directory ===")
    affected_files = find_key_occurrences(".", OLD_KEY)
    if affected_files:
        print(f"Found leaked key in {len(affected_files)} file(s):")
        for f in affected_files:
            print(f"  - {f}")
            rotated = rotate_key_in_file(f, OLD_KEY, NEW_KEY)
            print(f"    rotated: {rotated}")
    else:
        print(f"No files contain the leaked key ({OLD_KEY})")