The library research VM stores lookup-service API keys in a public gist for convenience. What should the analyst do with those secrets?
Select an answer to reveal the explanation.
Short Explanation
Keys in a public gist are a lost badge on the sidewalk. Automation secrets are OPSEC. Pull them down, rotate them, and keep them in the lab—not on the internet.
Full Explanation
API keys for lookup services authenticate the city and can leak investigation volume, billing, and access if exposed. When the library research VM stores lookup-service API keys in a public gist for convenience, the analyst should remove the keys from public repos and treat automation secrets as OPSEC—rotating anything that was exposed and restoring storage to the restricted research lab.
Leaving the gist public so any intern can copy the keys preserves the leak. Emailing the keys to a personal account as an unofficial backup moves secrets onto uncontrolled mail. Committing the keys into the city's public GitHub transparency organization publishes credentials under the banner of openness.
Exam caveat: transparency obligations rarely require publishing live API secrets; publish methods and non-sensitive documentation instead, and keep credentials in a secrets store or restricted lab config.
Operational check: delete or privatize the gist, rotate the exposed keys with the vendor, store replacements in approved lab secret storage, and brief interns that automation credentials are OPSEC assets. Keep municipal wording calibrated to what public sources actually show, and record retrieval dates so peers can re-perform the work.