`README.md`

33 lines
# GCP security case #72846716 — Gemini project compromise remediation kit

Google flagged project `gen-lang-client-…65425540` (AI Studio / Gemini API) as
possibly compromised and is throttling it. Prime suspects: two leaked orphan
Gemini keys (last-4 `ejMo`, `S2ic`) flagged by vp-security 2026-06-23, never
registry-managed, values since scrubbed from disk by secret-strip.

## Status (as of 2026-07-01)

- Master `GEMINI_API_KEY` (…-mvA) and `GEMINI_API_KEY_WALLCO` (…k720): both
  verified live (HTTP 200 on models list) — not throttled yet.
- Leaked key values no longer on disk anywhere (grep sweep clean) — the only
  live copies are on Google's side.
- No local credential can reach the project:
  - `info@designerwallcoverings.com` gcloud token: expired, needs interactive re-auth
  - ADC (`~/.config/gcloud/application_default_credentials.json`): same
  - `theagentabrams@gmail.com`: live, but cannot see any gen-lang-client project
  - `claude-gmc` SA: scoped to dw-gmc only

## To finish (one human step + one command)

1. Steve, in any terminal:
   `gcloud auth login info@designerwallcoverings.com`
   (or `steveabramsdesigns@gmail.com` if the AI Studio keys were made under the
   personal account — whichever login shows the gen-lang-client project)
2. Then: `./remediate.sh` (dry-run) → review → `./remediate.sh --apply`

Deletes are soft (30-day undelete). Kept keys get an API restriction limiting
them to the Generative Language API only.

After a fresh replacement key is issued, route it with the secrets skill:
`add GEMINI_API_KEY_DW_ENRICH <key>` (pre-staged slot, auto-fans-out).