Inventory Production Secrets
Build a production-secret register that names each credential's owner, storage path, scope, callers, and verified rotation method.
A team cannot rotate a secret it does not know exists. The first inventory should cover credentials used by production services, CI jobs, human operators, agents, and third-party integrations. It should not become a new file full of plaintext keys. OWASP's secrets guidance recommends centralized handling, limited access, and a lifecycle that includes rotation and revocation.
Begin with systems that issue credentials: cloud accounts, databases, payment and email providers, source control, model providers, and internal APIs. Ask owners for metadata and safe identifiers. Search only systems the team owns and is authorized to review. A repository scan may find old references, but it cannot prove which keys are active.
Secret register
| Field | Record |
|---|---|
| Provider and key ID | Safe identifier, never the secret value |
| Owner | Named team and backup contact |
| Purpose | Service or workflow that needs it |
| Storage | Secret manager, CI environment, or approved local store |
| Scope | Actions and resources the provider permits |
| Callers | Deployments, jobs, humans, and agents that use it |
| Rotation | Provider-side steps and expected overlap |
| Revocation proof | How to show the old value no longer works |
Do not paste key material into the register, screenshots, tickets, or chat. Treat unknown owners and unknown rotation methods as explicit review states. A duplicate key used by unrelated services needs a separation plan, because rotating it can break both at once.
Reconcile with reality
For each credential class, compare the register with provider-side listings and deployment references. Record discrepancies without copying secret values. Ask whether an unused key can be disabled after a controlled impact check. Verify a representative replacement in an owned test environment before making a production cutover plan.
A local session ending does not invalidate a copied key. Record the provider-side revocation endpoint or owner action and a safe test that checks rejection. Update the inventory after a release, offboarding, incident, or new integration. The artifact is an operational map that helps a human make later decisions, not permission to rotate production credentials automatically.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.