Outcome#
You can protect GitHub and ETH access, distinguish public from private SSH-key material, and respond safely if a credential is exposed.
Concept#
Commands run under your identity. A leaked token or private key may provide access to private repositories, research data, or shared compute even when no password was disclosed.
Worked Example#
Every credential-critical answer is correct before the mission can pass.
A correct example uses these decisions:
- A token may have been exposed. What comes first? Revoke or rotate it, then report through the private incident path.
- Which SSH file may be shared with a service? Only the public key ending in .pub.
- How should you verify GitHub MFA without exposing a secret? Check the authentication status in your own GitHub security settings; never submit a recovery code.
Common Trap#
Pasting a real token, private key, recovery code, or screenshot to prove that it exists.
If Blocked#
If you suspect a real exposure, stop the exercise and follow Incidents and getting help. Do not post the secret in a GitHub issue or ask an AI tool to inspect it.
Useful references:
Understand Before Accepting AI Output#
An AI-generated cleanup command may destroy evidence without revoking the credential. Verify the issuing service, scope, and incident path yourself.