remove leaked credentials