Category hub: Credentials, identity and exposure
In one sentence: Secret rotation means regularly replacing the passwords, keys and tokens that software uses to talk to other systems, so a stolen one stops working.
What is secret rotation?
A “secret” here is a credential that a program uses, not a person. Examples are API keys, database passwords, access tokens and SSH keys. They sit in settings files, build tools and cloud accounts, often for years.
OWASP’s Secrets Management Cheat Sheet says you should regularly rotate secrets so that any stolen credentials will only work for a short time. It adds that regular rotation also reduces the tendency to fall back to bad habits such as reusing credentials. It also says the right lifetime depends on what the secret protects.
How it works
- List your secrets: what each is, where it is stored and what it can reach.
- Create a new secret at the source, meaning the system it gives access to.
- Update every place that uses it, such as apps, scripts and pipelines.
- Disable the old secret and check that nothing breaks.
- Record the change. OWASP advises keeping metadata, such as when and by whom a secret was rotated.
Removing a secret from one tool is not enough. CircleCI told customers to rotate keys at the source and then store the new secrets on its platform, and said simply removing old ones from CircleCI is not enough.
Who it affects and how badly
- Sole trader to 10 staff (trades, small web developers): a leaked key for your website host or payment service can lead to a defaced site or fraudulent charges.
- 10 to 50 and 50 to 250 staff (SaaS start-ups, MSPs): keys for cloud accounts, backups and customer systems are a prime target. Not knowing where they are used slows recovery.
- 250 plus and regulated firms: compromised service credentials can expose personal data and trigger ICO reporting.
Real examples
- CircleCI (January 2023). The company reported that an unauthorised actor exfiltrated customer information on 22 December 2022, including environment variables, keys and tokens for third-party systems. It recommended all customers rotate their secrets, including OAuth tokens, project API tokens and SSH keys: CircleCI incident report.
How to detect it
- Keep a secrets inventory with owners and last-rotated dates. Gaps are your first finding.
- Scan code repositories and configuration for exposed keys. Treat any exposed key as compromised.
- Review cloud and application logs for use of a key from unexpected places or times.
- Check for unused, old or shared credentials.
How to fix or prevent it
- Put secrets in a managed store such as Azure Key Vault, AWS Secrets Manager or Google Secret Manager, which OWASP names.
- Rotate on a schedule and and immediately after any suspected exposure or incident.
- Automate rotation where you can, so no one has to remember every place a secret is used.
- Prefer short-lived credentials over long-lived ones.
- Give each secret the least access it needs, and one secret per service.
- Never store secrets in source code. Document where each is used so rotation is safe.
Related terms
- hard-coded-secrets
- api-key-exposure
- secrets-in-source-code-repositories
- infostealer-malware
- password-manager
- account-takeover
Also read: brute-force-attack, credential-stuffing, multi-factor-authentication.
Frequently asked questions
What is secret rotation?
It means regularly replacing the passwords, keys and tokens that software uses to talk to other systems, so a stolen one stops working.
When should I rotate a secret?
Rotate on a schedule and immediately after any suspected exposure or incident.
Is removing an old secret from one tool enough?
No. CircleCI told customers to rotate keys at the source and then store the new secrets, and said simply removing old ones was not enough.
How Wolfcore helps
Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy breach exposure monitoring.
Service page: Breachy breach exposure monitoring.