---
title: "Rotate every secret the previous team · Agent Wranglers"
url: https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets
id: TKO-2
level: Required
risk: takeover
updated: 2026-10-22
tokens: 796
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Rotate every secret the previous team could read

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TKO-2
- Level: Required
- Chapter: [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md)
- Rule: Replace every API key, database password, signing key and token that existed before the handover. Revoke the old values, so they stop working.
- Check: Every entry in the secrets store has a creation date after the handover date. A call with each old key, kept aside for the test, fails with an authentication error.
- Risk: An account or system taken over
- How: Anyone who had the code, a laptop with an env file or a chat with pasted keys still holds the old values. Find them in the env files, the full git history and each account from [Take control of every account before touching the code](https://agentwranglers.se/playbook/codebase-takeover/triage/take-control-of-accounts.md). A secret scanner over every commit finds keys that were deleted from the code but never revoked, as [Scan the whole history for secrets](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/history-secret-scan.md) says. Put the new values in a store, as [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store.md) says. Rotate signing keys for sessions last, since rotating them signs every user out.

## Sources

- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)

## Related rules

- TKO-1 [Take control of every account before touching the code](https://agentwranglers.se/playbook/codebase-takeover/triage/take-control-of-accounts.md) in Codebase takeover
- TKO-31 [Scan the whole history for secrets](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/history-secret-scan.md) in Codebase takeover
- ENG-26 [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store.md) in Engineering
- TKO-7 [Fix in risk order](https://agentwranglers.se/playbook/codebase-takeover/triage/fix-in-risk-order.md) in Codebase takeover

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets">Agent Wranglers codebase takeover playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Take control of every account before touching the code](https://agentwranglers.se/playbook/codebase-takeover/triage/take-control-of-accounts.md)
- Next: [Take a backup and restore it before the first change](https://agentwranglers.se/playbook/codebase-takeover/triage/restore-before-first-change.md)
- [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md)