During an incident where a GitHub App's private key or high-privilege credentials may be leaked, what should administrators do first?

The correct answer is revoke/rotate compromised credentials, review audit logs for abuse, and reissue with least privilege. Incident response for GitHub credentials prioritizes containment, then investigation and recovery. Options A–C are irresponsible. Follow enterprise IR runbooks, notify affected repo owners, enable additional detections, and consider short-lived credentials and IP allow lists to reduce future impact. Capture a timeline of when the key was generated, last rotated, and first suspected exposure so you can bound the abuse window in audit evidence for leadership and customers.