Delete the exposed GSLT
Valve instructs server operators not to distribute GSLTs and says to delete any token distributed to a third party. Steam Game Server Account Management lets signed-in users manage dedicated game-server accounts associated with their Steam accounts and create game-server accounts.
Steam also states that resetting a Steam password through the Steam Help website—or having Steam Support reset it—regenerates every GSLT associated with the account.
A GSLT that remains unused for a long period because its game server never logs in will expire. Steam says an expired token can be regenerated through the account-management page.
Evaluate Git cleanup after deleting the token
If the GSLT entered a Git repository, follow GitHub's sensitive-data removal guidance. GitHub says the first step for an exposed password, token, or credential is to revoke or rotate it. Once that is done, rewriting repository history may not be warranted.
GitHub documents several consequences of rewriting history: commit hashes change, dependent tooling can break, pull-request diffs and comments can be disrupted, and an old clone can reintroduce the sensitive data.
A history rewrite also does not remove every copy automatically. GitHub warns that the data may remain accessible through clones, forks, cached views, and pull-request references. Repository cleanup therefore requires coordination with collaborators and, in some cases, fork owners or GitHub Support.
Sources and verification
- Steam Game Server Account Management — Valve instructs operators not to distribute GSLTs and to delete tokens distributed to third parties; the page also describes game-server account management, password-reset regeneration of all GSLTs, and expiration and regeneration of long-unused tokens.
- Removing sensitive data from a repository — GitHub directs users to revoke or rotate exposed credentials first and documents the coordination requirements, limitations, and operational effects of rewriting repository history.