Critical ThreatDevSecOps & Supply ChainCWE-798
Automated API Key & Secret Rotation with Vault
Secure your infrastructure by implementing automated API key and secret rotation using HashiCorp Vault and Cloud KMS.
Vulnerability Overview
Long-lived, hardcoded credentials are a major risk of leakage.
Code leaks or insider threats expose static secrets.
Vulnerable Code
const dbPassword = 'supersecret';Hardcoded secret in source code.
Remediated Code
const dbPassword = await vault.read('secret/db/password');Retrieves secret dynamically.
Hardening Rules
- 1Use dynamic secrets
- 2Short-lived credentials
- 3Never log secrets
Frequently Asked Questions
Why dynamic secrets?
They are generated on-demand and expire automatically, minimizing the blast radius of a leak.