diff --git a/playbooks/credential-leak.md b/playbooks/credential-leak.md
new file mode 100644
index 0000000..2f79c2d
--- /dev/null
+++ b/playbooks/credential-leak.md
@@ -0,0 +1,6 @@
+# Playbook: credential in version control
+
+1. Rotate first. Always rotate first.
+2. Then worry about removing it.
+3. Deleting the branch does not remove it. Neither does force-pushing.
+4. Check pull request refs, forks and CI logs before you call it contained.