diff --git a/en/openapi/introduction.mdx b/en/openapi/introduction.mdx
index 18768f9d..fca4189a 100644
--- a/en/openapi/introduction.mdx
+++ b/en/openapi/introduction.mdx
@@ -65,6 +65,26 @@ An APP Key's effective access is constrained by both its permission scope and th
You can edit an existing APP Key's name and permission scope from the APP Key list.
+### What to do if an APP Key is exposed
+
+If you believe an APP Key has been exposed (for example, accidentally committed to a public code repository, or visible in logs or screenshots), act immediately:
+
+
+
+ Sign in to the [Flashduty Console](https://console.flashcat.cloud), go to **My → APP Key**, and create a new APP Key.
+
+
+ Update every integration, script, and configuration that uses the old key to the new one, and confirm they work.
+
+
+ Delete or disable the exposed key from the APP Key list so it stops working immediately and can no longer be abused.
+
+
+
+
+If you receive a key-exposure notification email from Flashduty, your key was found in a public channel (such as a public GitHub repository). The email includes the exposure location — follow the steps above to rotate the key as soon as possible.
+
+
### Usage example
Pass the APP Key as a query string parameter:
diff --git a/zh/openapi/introduction.mdx b/zh/openapi/introduction.mdx
index 9998035f..3b610f78 100644
--- a/zh/openapi/introduction.mdx
+++ b/zh/openapi/introduction.mdx
@@ -66,6 +66,26 @@ APP Key 的实际可访问范围同时受其权限范围和创建者当前角色
您可以在 APP Key 列表中编辑已有密钥的名称和权限范围。
+### APP Key 泄露了怎么办
+
+如果你怀疑某个 APP Key 已经泄露（例如被误提交到公开代码仓库、出现在日志或截图中），请立即按以下步骤处置：
+
+
+
+ 登录 [Flashduty 控制台](https://console.flashcat.cloud)，进入 **我的 → APP Key**，创建一个新的 APP Key
+
+
+ 将所有使用旧 Key 的集成、脚本和配置切换到新 Key，并确认工作正常
+
+
+ 在 APP Key 列表中删除或禁用已泄露的旧 Key，使其立即失效，避免被继续利用
+
+
+
+
+如果你收到 Flashduty 发送的密钥泄露通知邮件，说明你的 Key 在公开渠道（如 GitHub 公开仓库）被发现，邮件中会给出泄露位置，请按上述步骤尽快轮换。
+
+
### 使用示例
将 APP Key 作为 query string 参数传入：