e-volv

Security playbook

SecretRotationReminder

Monthly audit of vault metadata that files a ticket for any credential past its rotation policy, without ever reading a secret value.

Monthly, reads secret metadata from the workspace vault — name, type, createdAt, lastRotatedAt, and which integrations reference it — and produces an age report. Anything past its policy age (default: 90 days for API keys, 180 for signing keys, 30 for anything ever exposed) gets a ticket with the rotation runbook for that credential type and the list of services that will need redeploying afterward. Reads metadata only. Never reads, logs, or transmits a secret value.

Identifier
secret-rotation-reminder
Version
1.0.0
Steps
3
Triggers
1
  • secrets
  • rotation
  • security
  • compliance
  • vault
  • automated

When it runs

Scheduleschedule.monthly
Schedule
Day 1 of each month at 09:00 UTC 0 9 1 * *
Timezone
UTC

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

React Flow
  1. 01
    Monthly Schedule (1st, 09:00 UTC)trigger

    The event that starts the run.

  2. 02
    Analyze Secret Rotation Statusagent.run

    One agent works the task with its toolkit.

  3. 03
    File Rotation Ticketticket.create

    Opens a ticket on the connected tracker.

The agent

Secret Rotation Analyst

Base type
Senior Developer
Temperature
0.2
Max iterations
30
Tools
4

Filesystem · 1

  • read_fileRead File · read

Code search · 1

  • code_searchCode Search · read

Tickets · 1

  • create_ticketCreate Ticket · write

Status · 1

  • update_statusUpdate Status · write