secrets-management-reviewlisted

# Secrets Management Review Find where credentials are stored, who can read them, and how quickly they can be replaced. ## Purpose **Use this when:** - Reviewing how a service receives its credentials. - A secret has been committed, logged, or otherwise exposed. - Onboarding a service to production. - Deciding between a secret store, sealed secrets, and a cloud provider's native solution. **Do not use this when:** - The problem is TLS certificate validation — use `tls-debugging`. - The problem is IAM permissions rather than credential handling — use `aws-production-debugging`. **This skill is defensive.** It covers protecting credentials in systems you operate. It does not cover extracting credentials from systems you do not control. **What this skill assumes:** access to the repository, the deployment manifests, and the CI configuration. All three hold secrets in different ways, and reviewing only one misses most of the exposure. ## Operating Procedure 1. **Enumerate the secrets.** What credentials does this service need, and what does each grant? 2. **Trace each one's path** from where it is stored to where it is used. Every stop is an exposure point. 3. **Check each storage location** against the table in step 2 below. 4. **Check access**: who and what can read it, and is that audited? 5. **Check rotation**: can it be replaced without downtime, and has that ever been done? 6. **Check blast radius**: what does this credential grant, and can it be narrowed? 7.