Security playbook
Secret Rotation Reminder
Monthly audit of vault metadata that files a ticket for any credential past its rotation policy, without ever reading a secret value.
Monthly, reads secret metadata from the workspace vault (name, type, createdAt, lastRotatedAt, and which integrations reference it), and produces an age report. Anything past its policy age (default: 90 days for API keys, 180 for signing keys, 30 for anything ever exposed) gets a ticket with the rotation runbook for that credential type and the list of services that will need redeploying afterward. Reads metadata only. Never reads, logs, or transmits a secret value.
- Identifier
secret-rotation-reminder- Version
- 1.0.0
- Steps
- 3
- Triggers
- 1
- secrets
- rotation
- security
- compliance
- vault
- automated
When it runs
schedule.monthly- Schedule
- Day 1 of each month at 09:00 UTC
0 9 1 * * - Timezone
- UTC
The pipeline
The graph below is the one the workflow opens with in the builder, same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.
- 01Monthly Schedule (1st, 09:00 UTC)
triggerThe event that starts the run.
- 02Analyze Secret Rotation Status
agent.runOne agent works the task with its toolkit.
- 03File Rotation Ticket
ticket.createOpens a ticket on the connected tracker.
The agent
Secret Rotation Analyst
- Base type
- Senior Developer
- Temperature
- 0.2
- Max iterations
- 30
- Tools
- 4
Filesystem · 1
read_fileRead File · read
Code search · 1
code_searchCode Search · read
Tickets · 1
create_ticketCreate Ticket · write
Status · 1
update_statusUpdate Status · write