SendGrid API key (SG.) leaked: revoke and audit mail logs

1. Step 01

   SendGrid → Settings → API Keys → Delete the leaked key.

2. Step 02

   Create a new key with restricted permissions (e.g. Mail Send only).

3. Step 03

   Activity Feed → filter for the leak window. Suspicious bursts = compromised; contact SendGrid support.

Step 01 — Revoke

Kill the leaked credential first

Settings → API Keys → three dots next to the leaked key → Delete. Confirm. Create New API Key → "Restricted Access" → check only Mail Send (uncheck everything else).

Step 02 — Rotate

Update the new key in the right place

Server-side env vars only — never in client code, never with NEXT_PUBLIC_.

import sgMail from '@sendgrid/mail';
sgMail.setApiKey(process.env.SENDGRID_API_KEY!);  // server only

Step 03 — Scan

Confirm nothing else leaked alongside it

Scan your live URL for any other transactional or messaging secrets in your bundle.

How this usually leaks

• 01Hardcoded in a client component for "contact form" sends.
• 02Embedded in a config.json deployed to /public/.
• 03.env committed to source control.