Leaked GSLT? Delete the Token Before Rewriting Git History

[ice]

If a Game Server Login Token (GSLT) was exposed to a third party, delete it through Steam Game Server Account Management before considering a Git history rewrite.

Delete the exposed GSLT

Valve instructs server operators not to distribute GSLTs and says to delete any token distributed to a third party. Steam Game Server Account Management lets signed-in users manage dedicated game-server accounts associated with their Steam accounts and create game-server accounts.

Steam also states that resetting a Steam password through the Steam Help website—or having Steam Support reset it—regenerates every GSLT associated with the account.

A GSLT that remains unused for a long period because its game server never logs in will expire. Steam says an expired token can be regenerated through the account-management page.

Evaluate Git cleanup after deleting the token

If the GSLT entered a Git repository, follow GitHub's sensitive-data removal guidance. GitHub says the first step for an exposed password, token, or credential is to revoke or rotate it. Once that is done, rewriting repository history may not be warranted.

GitHub documents several consequences of rewriting history: commit hashes change, dependent tooling can break, pull-request diffs and comments can be disrupted, and an old clone can reintroduce the sensitive data.

A history rewrite also does not remove every copy automatically. GitHub warns that the data may remain accessible through clones, forks, cached views, and pull-request references. Repository cleanup therefore requires coordination with collaborators and, in some cases, fork owners or GitHub Support.