# Playbook: credential in version control

1. Rotate first. Always rotate first.
2. Then worry about removing it.
3. Deleting the branch does not remove it. Neither does force-pushing.
4. Check pull request refs, forks and CI logs before you call it contained.