What should I do if my AI API key leaked on GitHub?

Revoke the leaked key immediately in the provider's console, then create a new one. Deleting the file from your repository is not enough because the key remains in history, forks and clones.

Steps:

1. Revoke or delete the exposed key first. Do this before anything else.
2. Create a replacement and store it in an environment variable or secrets manager.
3. Check your usage and billing for activity you did not make.
4. Test that the old key now fails.
5. Remove the key from the code and, if appropriate, clean the history, treating that as a secondary step.
6. Turn on secret scanning or push protection in your code host.
7. Tell your team or security contact.

Some providers take part in programs that detect keys found in public repositories and may disable them, but do not rely on that, and it does not cover private repos. Your provider's support pages describe their exact process.