Agent WranglersTKO-2Required
Rotate every secret the previous team could read
Replace every API key, database password, signing key and token that existed before the handover. Revoke the old values, so they stop working.
How to do it
Anyone who had the code, a laptop with an env file or a chat with pasted keys still holds the old values. Find them in the env files, the full git history and each account from Take control of every account before touching the code. A secret scanner over every commit finds keys that were deleted from the code but never revoked, as Scan the whole history for secrets says. Put the new values in a store, as Keep secrets in a secrets store says. Rotate signing keys for sessions last, since rotating them signs every user out.
How to check
Every entry in the secrets store has a creation date after the handover date. A call with each old key, kept aside for the test, fails with an authentication error.
Sources
Related rules
- TKO-1 Take control of every account before touching the code in Codebase takeover
- TKO-31 Scan the whole history for secrets in Codebase takeover
- ENG-26 Keep secrets in a secrets store in Engineering
- TKO-7 Fix in risk order in Codebase takeover
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets">Agent Wranglers codebase takeover playbook</a>. In code you write, add a comment next to it with the same link.