Skip to main content
When an Unkey root key is pushed to a public GitHub repository, GitHub tells us and we email everyone in the workspace that owns it. We don’t revoke or disable the key. That’s up to you. GitHub recognizes Unkey root keys by their unkey_ prefix. Don’t rely on this detection for the API keys you issue with your own prefixes.

​
What happens

1

GitHub finds the key

GitHub spots a string that looks like an Unkey root key in a public repository and reports it to us with the URL where it was found.
2

Unkey checks the reported key

Unkey verifies GitHub’s signature and looks up the reported key’s hash. If the key or its workspace has been deleted, or no key matches, nobody is emailed. This check doesn’t test whether the key is enabled or expired.
3

Your team gets an email

Every member of the workspace gets an email naming the source and the URL where the key was found. Repeated copies of a key within one report produce one notification per member. A separate report can produce another notification.

​
What you should do

Treat the key as compromised. Anyone could have copied it, so replacing it is the only fix:
  1. Under Root Keys in the dashboard sidebar, rotate the key with “revoke immediately”, or delete it.
  2. Update the service that used it. If the key is stored as a Compute environment variable, find every app that sets it.
  3. Remove the secret from the repository’s history.
Last modified on October 28, 2026