# If you've used Apifox, run a self-check immediately

# 1. Detect if compromised (Note: Binary file detection has false negative risks; results are for reference only)
# macOS:
grep -arlE "rl_mc|rl_headers" ~/Library/Application\ Support/apifox/Local\ Storage/leveldb
# Linux:
grep -arlE "rl_mc|rl_headers" ~/.config/apifox/Local\ Storage/leveldb
# Windows PowerShell:
Select-String -Path "$env:APPDATA\apifox\Local Storage\leveldb\*" -Pattern "rl_mc","rl_headers" -List
# 2. Regardless of detection results, it's recommended to perform the following:
# Rotate SSH keys
cd ~/.ssh && ls -la # First check what keys you have
# Generate new replacements for each key and update authorized_keys on all servers
# 3. Revoke and regenerate Git Tokens
# GitHub: Settings → Developer settings → Personal access tokens → Revoke all
# GitLab: Same process
# 4. Rotate K8s credentials
# kubectl config view → Check and rotate each one
# 5. Rotate npm Token
npm token revoke
npm token create
# 6. Check .zsh_history / .bash_history for all exposed plaintext passwords and Tokens
# Yes, if you've ever typed passwords on the command line, they may already be compromised
#apifox