Docs / Reference
Secrets: leak prevention & rotation
A credential will eventually end up somewhere it shouldn't — a config file, a CI log, a support ticket, a public comment. Perryscope treats accidental credential publication as an assumed failure mode, not an edge case: prevent what's cheap to prevent, scan everywhere a secret could land, and make revocation fast enough that a leak is a non-event.
Prevention gate
- Secret manager only. No credential is committed, hardcoded, or pasted into a config file, ticket, or doc — production and CI pull secrets from the secret manager at runtime.
- Scoped credentials. Every key is least-privilege and single-purpose (per service, per environment) so one leaked credential has a bounded blast radius, not standing access to everything.
.env*, key files, and dumps stay in.gitignore— never relied on as the only backstop.- The pre-commit hook (see the CLI) runs before a secret can enter history in the first place.
Scan coverage
| Surface | Coverage |
|---|---|
| Source repos | Pre-commit blocks new secrets; a scheduled deep scan covers HEAD, every branch, and full commit history (see Scanning modes). |
| CI logs | Build and pipeline logs are scanned before retention; env vars are masked at the CI-provider level so they never render in plaintext output. |
| Frontend bundles | Production JS/CSS bundles are scanned post-build — anything client-shipped is public by definition, so a secret in a bundle is treated as already leaked. |
| Support artifacts | Tickets, screenshots, and shared logs attached to support or bug reports are scanned before or at time of attachment. |
| Documentation | Docs, READMEs, and runbooks (including this site) are scanned — example values must be clearly fake, not real credentials with the risk "explained away". |
| Deployment config | IaC, compose/manifest files, and environment templates are scanned for embedded values instead of secret-manager references. |
Command template
Install the hook locally, and run the deep, full-history scan on a schedule and after any incident.
# local pre-commit gate python -m radar_scanner.cli install python -m radar_scanner.cli scan-staged -v # scheduled / post-incident deep scan (HEAD + all branches + history) perryscope scan acme-corp/repo --mode deep --history full
Revocation & rotation runbook
- Treat every confirmed-live finding as already compromised — revoke at the provider first, investigate second.
- Revoke or disable the exposed credential at the issuing provider immediately; do not wait for rotation to be "convenient".
- Issue a new, scoped replacement and update it only in the secret manager — never back into the leaked location.
- Rotate the credential everywhere it's referenced (CI, deployment config, other services) so nothing keeps using the revoked value.
- Purge the exposed value from CI logs, caches, and any public copy (comment, ticket, page) it reached.
- Audit provider access logs for the exposure window for unauthorized use.
- Notify affected stakeholders if the exposure window or audit shows actual unauthorized access.
- Record the incident: what leaked, where, exposure window, time-to-revoke, and the prevention gap it closes.
Applies to every repository, CI pipeline, frontend build, support channel, documentation source, and deployment config under Perryscope's control.