Record the exposure without redistributing it
Note what was shared, where and when. Remove the public copy where you can, but do not assume that deletion removes every saved copy or log.
Do not forward the unredacted credential to more people while asking whether it is dangerous. A redacted description can explain the event without repeating the disclosure.
Use the actual provider’s recovery process
Contact the service through a verified published route and ask how the affected password, token or session can be replaced or revoked. The available controls differ between services.
If you reused a password elsewhere, protect those other accounts through their own official processes. Prioritise the email or other recovery account that can control access to the rest. Never send recovery codes to someone who unexpectedly contacts you.
Review sessions where the provider supports it
Some accounts expose device or session management. Follow the provider’s documented guidance to review unfamiliar access. A new device label is a clue to investigate, not automatic proof of who accessed the account.
Keep your own known devices in mind so you do not confuse a normal software update or renamed device with an intruder. Preserve any useful provider notices without publishing personal information.
Rebuild the private setup carefully
After authorised replacement of the access details, update the devices you control using the service’s normal method. Remove obsolete copies from shared documents or public screenshots.
NCSC’s general account-recovery guidance supports unique passwords, appropriate session review and two-step verification where offered. Those habits do not guarantee that a particular service has every feature. Confirm what was actually revoked or changed rather than declaring the incident resolved because playback works again.
Questions about this guide
Does a working player prove the exposed token was revoked?
No. Playback and credential revocation are different observations. Ask the actual service what action was completed.
Should I change reused passwords on other accounts?
Use those providers’ official recovery or password-change processes, especially for an important recovery email account.