SecretUndo FAQ

Last updated: October 25, 2026

Find answers about SecretUndo accounts using SecretUndo FAQ, Google sign-in, GitHub access, secret detection, credential remediation, privacy and account deletion.

About SecretUndo

What is SecretUndo?

SecretUndo is a developer-security service designed to help detect exposed credentials and complete the remediation process. Its goal is to go beyond alerting by helping users identify ownership, understand potential blast radius, rotate or revoke supported credentials, prepare cleanup work and verify that old credentials no longer work.

How is SecretUndo different from an ordinary secret scanner?

Most secret scanners focus on detection. SecretUndo is designed around remediation: deduplicating related exposures, identifying affected repositories and environments, providing confirmation-gated provider actions, generating cleanup guidance and verifying revocation.

Is SecretUndo free?

SecretUndo is currently offered without a mandatory subscription fee. Your internet, hosting, cloud-provider or other third-party usage may still have costs outside SecretUndo. If optional paid features are introduced later, pricing will be disclosed before any charge is made.

Who operates SecretUndo?

SecretUndo is operated by StoryTimeAndConfessions in India. Support enquiries may be sent to [email protected].

Accounts and Google sign-in

Why is Google sign-in required?

Google sign-in provides a widely supported authentication method and allows SecretUndo to verify account identity without creating or storing a separate SecretUndo password.

What Google information does SecretUndo receive?

SecretUndo requests only basic authentication information: your stable Google account identifier, email address, display name, profile image and email-verification status.

Can SecretUndo read my Gmail or Google Drive?

No. SecretUndo authentication uses only the openid, email and profile scopes. It does not request access to Gmail, Google Drive, Google Calendar, contacts or other Google content.

Does SecretUndo store my Google password?

No. Google handles the sign-in process. SecretUndo does not receive or store your Google password.

Can I revoke Google access?

Yes. You can revoke SecretUndo through the third-party connections or permissions area of your Google Account. Revoking access prevents future Google authentication but does not automatically delete your SecretUndo data. Use the account-deletion process if you also want the SecretUndo account deleted.

GitHub connection and permissions

How does SecretUndo connect to GitHub?

SecretUndo uses a GitHub App installation. GitHub shows the requested permissions and lets you choose the account or organization and, where supported, the repositories SecretUndo may access.

Can I limit access to selected repositories?

Yes. When GitHub offers repository selection for the installation, choose only the repositories you want SecretUndo to access. Repository access may be changed later through GitHub’s installation settings.

Can SecretUndo access private repositories?

Only when you explicitly authorize the GitHub App to access them and you have permission to grant that access. SecretUndo cannot access repositories outside the GitHub App installation permissions.

How do I disconnect GitHub?

Open the Applications or GitHub Apps section of your personal or organization settings on GitHub, locate SecretUndo and suspend or uninstall the installation. Organization installations may require an organization owner.

Detection and incident handling

What types of secrets can SecretUndo detect?

SecretUndo is designed to recognize common credential formats such as API tokens, cloud access keys, private keys, webhook secrets and provider-specific credentials. Detection coverage may change as providers and credential formats evolve.

Does SecretUndo guarantee that every secret will be detected?

No. Secret detection is probabilistic. A scanner can produce false positives or miss a credential whose format is unknown, transformed, fragmented or otherwise difficult to recognize. SecretUndo should be one part of a broader security program.

Does SecretUndo store complete exposed credentials?

SecretUndo is designed not to retain complete plaintext credentials in its incident database. It may process a candidate long enough to classify it, calculate a non-reversible fingerprint, perform an authorized validity check and produce remediation guidance. Stored incident information may include a fingerprint, masked value, type and repository location.

What is incident deduplication?

The same credential may appear in multiple commits, branches, forks or mirrored repositories. SecretUndo uses a non-reversible fingerprint and contextual metadata to group related occurrences into one remediation workflow where appropriate.

What is blast-radius discovery?

Blast-radius discovery attempts to identify where an exposed credential may be used, which environments or repositories may depend on it and what systems could be affected by rotation or misuse. Results should be reviewed before remediation.

What does credential validity mean?

A validity check attempts to determine whether a credential is accepted by its provider. An invalid result does not prove that the credential never worked or that every copy has been revoked. Provider availability and permission limitations can also affect the result.

Rotation, revocation and cleanup

Does SecretUndo rotate credentials automatically?

High-impact remediation is confirmation-gated. SecretUndo should not rotate or revoke a supported credential until an authorized user reviews and confirms the proposed action.

Why is confirmation required?

Rotating or revoking a credential can interrupt applications, deployments and integrations. Confirmation gives an authorized user an opportunity to review ownership, dependencies, affected environments and rollback plans.

Which credential providers are supported?

Provider support depends on available and secure provider APIs. SecretUndo’s design prioritizes commonly used services such as GitHub, AWS and Stripe, with additional integrations added only when they can be implemented safely.

Can SecretUndo clean a leaked secret from Git history?

SecretUndo can provide cleanup guidance and a history-rewrite plan where appropriate. Rewriting Git history is disruptive and may require every contributor and deployment environment to resynchronize. Review and coordinate the plan before performing a rewrite.

Does removing a secret from the latest file revision solve the incident?

Not by itself. The secret may remain in earlier commits, forks, logs, caches or deployed environments. The credential should generally be rotated or revoked, affected systems updated and historical exposure assessed.

How does SecretUndo verify revocation?

Where the provider supports a safe verification method, SecretUndo may check whether the old credential is rejected after remediation. Verification does not replace provider audit logs or a complete incident investigation.

Security and privacy

How does SecretUndo protect sessions?

SecretUndo is designed to use secure HTTPS connections, HTTP-only session cookies, hashed session tokens, limited provider permissions, security headers and audit events.

Does SecretUndo sell personal or repository data?

No. SecretUndo does not sell personal information, repository information or secret-incident metadata, and does not use that information for targeted advertising.

Where can I read the Privacy Policy?

Read the SecretUndo Privacy Policy for details about account information, repository metadata, retention, providers and user rights.

Where can I read the Terms and Conditions?

Read the SecretUndo Terms and Conditions.

Account deletion and support

How do I delete my SecretUndo account?

Follow the instructions on the SecretUndo Account Deletion page. Send the request from the email address used for Google sign-in so that account ownership can be verified.

How long does account deletion take?

StoryTimeAndConfessions aims to acknowledge valid requests within seven days and complete verified deletion requests within 30 days. Encrypted backups may retain residual information for up to 30 additional days before ordinary overwriting.

Will deleting SecretUndo undo a credential rotation or GitHub pull request?

No. Account deletion cannot reverse completed external actions such as credential rotation, revocation, commits, pull requests or history changes.

How do I report a security problem?

Email [email protected] with the subject “SecretUndo Security Report.” Describe the issue without including live passwords, private keys, access tokens or complete exposed secrets.

How do I contact support?

Email [email protected]. Include the affected page or feature, the approximate time of the issue and a request identifier if one was displayed. Never include a complete credential.