Scoped API Keys for CI Pipelines: Least-Privilege Rotation After Build Log Leaks

Short answer: give each CI job a short-lived, narrowly scoped API key, keep it out of build output, and make revocation a tested path rather than an incident-day improvisation. The deciding constraint is blast radius: one leaked key should be able to do one job for one repository, not become a standing credential for the whole customer-support...