What changes when GitHub reports a leaked token
Cloudflare said on November 11, 2026 that GitHub secret scanning detects exposed Cloudflare Access service token secrets in public repositories and reports them to Cloudflare. Access disables the affected token and emails account administrators. To restore access with that token, rotate the secret, update the callers, re-enable the token, and then verify a request.
What happened and why it matters
A disabled service token can interrupt scheduled jobs and integrations that use it to reach an Access-protected application. Identify the token in the Cloudflare dashboard and list the workloads that use it. The token stays disabled during rotation; rotating alone does not restore access.
- List the apps, CI jobs, scripts and integrations that use the affected token.
- For each caller, record its owner, where the credential is configured and how to reload it.
- Keep secret values out of the inventory, tickets, chat and logs.
A safe recovery workflow
Rotate the client secret on the affected token. A leaked secret has no rotation grace period: Cloudflare discards the previous value immediately. Save the replacement in your approved secret store, update each caller and reload workloads that read credentials only at startup. Keep the token disabled while you check that the new configuration has reached each caller.
Re-enable the token after rotation and the caller updates. Then send one controlled request from a known caller to a read-only route that requires that token. Check for the expected application response rather than a sign-in page or redirect. Monitor the other callers for authentication failures; one passing request does not verify every job.
Practical checklist
- Confirm the alert and identify the disabled token.
- Rotate the secret without a grace period.
- Update and reload the callers, then re-enable the token.
- Verify one protected request and monitor the remaining callers.
Reference
For API-based rotation, Cloudflare says to omit previous_client_secret_expires_at: a future expiry returns HTTP 400. A re-enable attempt before rotation returns HTTP 409. Both responses are reasons to check the recovery sequence before trying again.
Cloudflare changelog: leaked service token recovery
Cloudflare Access service tokens documentation
