{
  "id": "uc_ac341dd17ef8",
  "slug": "leaked-api-key-instant-rotation-and-blast-radius",
  "asset_type": "use_case",
  "name": "Leaked Credential Blast-Radius Audit & Zero-Downtime Rotation",
  "tagline": "Detect exposed secrets in git history or logs, audit 30-day API access logs for abuse, and rotate keys across Cloudflare and Vercel.",
  "description_md": "### 1. Problem & Operational Bottleneck\nDetect exposed secrets in git history or logs, audit 30-day API access logs for abuse, and rotate keys across Cloudflare and Vercel. Built and battle-tested in production workflows by **@threepointone** (Sunil Pai (@threepointone)).\n\n### 2. Target Architecture & Required Stack\n- **Cloudflare MCP**\n- **Vercel MCP**\n- **GitHub MCP**\n- **Slack MCP**\n\n### 3. Step-by-Step Implementation Blueprint\n1. Configure and authenticate the required MCP connectors (Cloudflare MCP, Vercel MCP, GitHub MCP, Slack MCP) in your agent workspace.\n2. Run the initial read-only inspection pass for 'Leaked Credential Blast-Radius Audit & Zero-Downtime Rotation' to gather baseline telemetry, schemas, and context.\n3. Execute the multi-step analysis and transformation pipeline with strict schema validation and zero fabricated identifiers.\n4. Review the staged diff or approval card and verify completion via automated regression and status checks.\n\n### 4. Copy-Paste Agent Execution Prompt\n```markdown\nRun the 'Leaked Credential Blast-Radius Audit & Zero-Downtime Rotation' (leaked-api-key-instant-rotation-and-blast-radius) implementation blueprint using Cloudflare MCP, Vercel MCP, GitHub MCP, Slack MCP. Objective: Detect exposed secrets in git history or logs, audit 30-day API access logs for abuse, and rotate keys across Cloudflare and Vercel. Step 1: Perform a read-only audit of current state and recent logs. Step 2: Generate a deterministic execution plan with exact diffs, SQL/CLI commands, or drafted payloads. Step 3: Request human confirmation before applying any production writes or external sends.\n```\n\n### 5. Verification & Safety Guardrails\n- **Human-in-the-Loop Gate:** All external communications, production database mutations, and billing actions stage an explicit review diff before execution.\n- **Deterministic Telemetry:** Every run logs structured JSON output, latency metrics, and source citations so operators can audit every decision.\n",
  "primary_category": "security-ops",
  "categories_json": "[\"security-ops\", \"use-cases\"]",
  "tags_json": "[\"cloudflare-mcp\", \"vercel-mcp\", \"github-mcp\", \"blueprint\", \"security-ops\"]",
  "compatible_agents_json": "[\"grok-bot\", \"claude-code\", \"cursor\"]",
  "integrations_json": "[\"Cloudflare MCP\", \"Vercel MCP\", \"GitHub MCP\"]",
  "includes_json": "[]",
  "safety_level": "Read-Only / Ask-First",
  "safety_summary": "Verified capability blueprint by @threepointone.",
  "share_url": "",
  "deep_link_uri": "",
  "mcp_endpoint": "",
  "mcp_transport": "http",
  "install_command": "npx lightstate inspect leaked-api-key-instant-rotation-and-blast-radius",
  "skill_markdown": "",
  "starter_prompt": "Run the 'Leaked Credential Blast-Radius Audit & Zero-Downtime Rotation' (leaked-api-key-instant-rotation-and-blast-radius) implementation blueprint using Cloudflare MCP, Vercel MCP, GitHub MCP, Slack MCP. Objective: Detect exposed secrets in git history or logs, audit 30-day API access logs for abuse, and rotate keys across Cloudflare and Vercel. Step 1: Perform a read-only audit of current state and recent logs. Step 2: Generate a deterministic execution plan with exact diffs, SQL/CLI commands, or drafted payloads. Step 3: Request human confirmation before applying any production writes or external sends.",
  "project_url": "https://x.com/threepointone",
  "repo_url": "",
  "creator_handle": "threepointone",
  "creator_name": "Sunil Pai (@threepointone)",
  "creator_avatar_url": null,
  "creator_url": "https://x.com/threepointone",
  "creator_platform": "x",
  "creator_cal_url": null,
  "claimed_by_user_id": null,
  "scouted_by_handle": null,
  "source_url": "https://x.com/threepointone",
  "source_tweet_id": null,
  "source_origin": "certified_builder",
  "source_posted_at": null,
  "x_likes": 255,
  "x_bookmarks": 465,
  "x_retweets": 116,
  "x_views": 3570,
  "human_upvotes": 255,
  "human_installs": 255,
  "bot_pulls": 465,
  "pulse_score": 84,
  "gravity_rank_score": 1927.5,
  "is_featured": 0,
  "is_verified": 1,
  "is_sponsored": 0,
  "sponsor_tier": "free",
  "sponsor_label": "",
  "sponsor_cta_url": "",
  "sponsor_expires_at": null,
  "commercial_intent_score": 0,
  "status": "active",
  "created_at": "2026-10-24T22:25:00Z",
  "updated_at": "2026-10-24T22:25:00Z",
  "verified_at": null,
  "primitive": "use_case",
  "title": "Leaked Credential Blast-Radius Audit & Zero-Downtime Rotation",
  "description": "Detect exposed secrets in git history or logs, audit 30-day API access logs for abuse, and rotate keys across Cloudflare and Vercel.",
  "category": "security-ops",
  "tags": "[\"cloudflare-mcp\", \"vercel-mcp\", \"github-mcp\", \"blueprint\", \"security-ops\"]",
  "agent_compatibility": "[\"grok-bot\", \"claude-code\", \"cursor\"]",
  "author_handle": "threepointone",
  "author_name": "Sunil Pai (@threepointone)",
  "author_avatar": null,
  "source_tweet_url": "https://x.com/threepointone",
  "github_url": "",
  "external_url": "https://x.com/threepointone",
  "upvotes_count": 255,
  "installs_count": 255
}