Compromised Credential Rule. Treat an exposed credential, generated secret, private key, or client config as compromised by default. Rotate it, invalidate the old value, and repair history or access paths where necessary instead of trying to prove no one used it.
The Services README states the rule operationally: if a generated secret was ever committed, rotate it, remove it from Git history if needed, and invalidate the old credential. This turns credential exposure into a deterministic recovery path rather than an argument about likelihood. It is a specialized revocation rule: once exposure is known, old authority ends.