🎯 Mission Briefing: Leaked Credentials

The security team got an alert: a live payment API key (it starts with sk_live_) was written to the application logs by a debug statement. Anyone who can read those logs could charge customers' cards. The payments team has already rotated the key — your job is to clean up after it.

Your objective

Find every log file that contains the key, count the damage, scrub the key out, and make sure the logs aren't readable by everyone.

Toolkit

grep -r "sk_live_" /var/log/app             # Which files, which lines?
grep -c "sk_live_" /var/log/app/app.log     # How many times in one file?
grep -rl "sk_live_" /var/log/app            # Just the file names
sudo sed -i 's/sk_live_[A-Za-z0-9]*/sk_live_REDACTED/g' FILE   # Replace in place (the logs belong to root)
ls -l /var/log/app                          # Who can read these files?
sudo chmod 640 FILE                         # Owner read/write, group read, others nothing

⚠️ sed -i edits the file in place. On a real server, make a copy first if you're not sure your pattern is right.