Skip to main content

Secrets management

The steady state the STOP secrets sweep leaves behind, and the standard every RAPID build inherits. Especially load-bearing here: you cannot safely point agents at a codebase whose secrets live in the code.

The rules​

  • Central vault — all secrets from a vault, never in code, config, prompts or agent context windows.
  • Short-lived credentials — scoped to the task, rotated automatically (see agent guardrails).
  • Pre-commit + CI gates — block any secret before it lands; part of the merge gate and security gates.
  • No secret in an agent's context — a leaked secret in a prompt or context window is a leaked secret. Guardrails prevent agents reading secret stores.

STOP sweep → steady state​

STOP does the one-time sweep: scan all repos and pipelines, rotate everything found, move to the vault. This standard is what stops it recurring — the gate that makes the sweep a one-off, not an annual ritual.

Standards referenced: OWASP ASVS.