Skip to main content

Secrets hygiene sweep

The one-time STOP runbook that gets secrets out of the estate — and keeps them out — before agents are pointed at it. Cheap, high-impact, and a hard prerequisite: an agent given a repo reads everything in it, history included, so a credential in a 2019 commit is a credential in an agent's context window. The steady state this sweep leaves behind is the secrets-management standard; this page is how you get there once.

Execution order​

The order matters — rotate before you tidy, gate before you declare done:

  1. Inventory — every repo, CI/CD pipeline, config store and deployment script in scope. Nothing exempt: the "dead" repo nobody touches is exactly where the live production database credential lives.
  2. Scan, history included — full git history plus pipeline variables, build logs and artefacts. A secret "removed" in a later commit is still in the history, and history is what gets cloned.
  3. Treat every hit as live until proven otherwise — assume compromise; verification costs more than rotation. Findings are logged (redacted) with repo, path, commit and credential type.
  4. Rotate first — rotate every credential found before any history rewriting. Purging history without rotating just hides the evidence of an exposure that already happened.
  5. Move to the vault — replace in-code values with vault references; the consuming service is re-pointed and verified working before the old credential is revoked.
  6. Purge history where exposure requires it — where the finding carries UK GDPR, FCA or contractual exposure (e.g. a policyholder-data API key shared with a third-party MGA). Rotation is the control; the purge is tidy-up, never a substitute.
  7. Enable the gate — pre-commit hook plus the CI secrets scan, zero-tolerance, on every swept repo (merge gate, scanning pipeline). The sweep is not complete until the gate that prevents recurrence is on — otherwise it's an annual ritual, not a one-off.

Evidence to record​

  • Findings count by type and repo (redacted) — the before-photo.
  • Rotation log — what was rotated, when, by whom; anything that cannot be rotated exits only via a signed risk-acceptance record with compensating controls.
  • Vault migration confirmation per credential — old value revoked, service verified on the new one.
  • Gate-enabled date per repo — the line after which any new finding is a gate failure, not a sweep item.

Evidence lands in toolkit/registers/ (unrotatable items as security-debt rows) and counts toward the STOP exit gate.

Pending tooling and credential owners

Scanner choice is a placeholder until the tooling evaluation lands. Rotation needs the credential owners at the table — some legacy insurer and third-party integrations carry contractual rotation notice periods, so name an owner per credential class (internal / cloud / third-party) before starting, or step 4 stalls mid-sweep.

Standards referenced: OWASP ASVS (secrets and configuration controls).