Rotating the key is the easy part, the slow part is finding every place the old one was copied: CI caches, forked repos, and log vendors that already ingested it. Checking provider usage logs for calls from unknown IPs before revoking tells you if it was actually used. Do you recommend revoking first or auditing first when the key powers production traffic?

iin1006h06