# pull.secrets: The downloaded source holds a credential

> The downloaded source holds a credential

| Where            |
| ---------------- |
| the `taggor` CLI |

## What to do

Nothing was written. Treat the key as leaked: rotate it, then publish a fixed version and pull that one.