Environment Secrets Audit and Rotation
Audit secret exposure, diagnose environment drift, and build credential rotation plans with explicit verification steps.
Before & after
Same prompt, same agent — the only difference is the skill.
I can help you audit your environment files for security issues. There are a few things to check — whether any secrets have been committed to git, whether your .env files are properly ignored, whether you're using secrets management tools in production, and whether your team has access controls. I'd want to look at your repository structure and your current process. Generally, secrets should never be in version control, and you should use a secrets manager like Vault or a service-provided option instead. Do you have a .gitignore set up to exclude your .env files?
ENVIRONMENT VARIABLE SECURITY AUDIT REPO SCAN: Secrets found in git history • .env (committed Dec 2024) — Contains: DATABASE_PASSWORD, STRIPE_SECRET_KEY, JWT_SECRET Risk: HIGH — Anyone with repo access has production credentials Action: Rotate all 3 secrets immediately. Use git-filter-branch to remove from history. • config/database.yml (committed Mar 2024) — Contains: db_password in plaintext Risk: CRITICAL — Database password exposed for 150 days Action: Reset database user password now. Audit database access logs for unauthorized activity. • .env.production (NOT committed, good) — Current state: 47 vars, all safe LOCAL DEVELOPMENT DRIFT .env.local (your machine) vs .env.example (team template): • You have: SENTRY_DSN, NEW_FEATURE_FLAG (extras) • Team doesn't have: SENTRY_DSN • Risk: MEDIUM — Env drift means new team members miss required secrets Action: Sync .env.example with all required vars (including Sentry) PRODUCTION SECRETS LEAKAGE Env vars not protected: • DATABASE_PASSWORD: stored in Vercel env (GOOD) • STRIPE_SECRET_KEY: stored in Vercel env (GOOD) • API_BASE_URL: hardcoded in code (BAD if it contains credentials) Risk: LOW (URL only, no secrets embedded) Third-party secret exposure: • GitHub Actions: .env.production hardcoded in deploy step (BAD) Risk: CRITICAL — GitHub Actions logs are world-readable if workflow fails Action: Use GitHub Secrets instead. Change all secrets from this workflow immediately. ROTATION READINESS Secrets last rotated: Never documented Action: Create rotation schedule: quarterly for API keys, immediately for leaked keys Secrets by type: • Database password: rotatable (1h downtime) • Stripe API key: rotatable (5 min, no downtime) • JWT secret: rotatable (5 min, sessions expire 24h, safe to swap) ACCESS CONTROL Team members with access to Vercel env: • drew@omnispark.co (GOOD) • 3 team members (need review) Action: Audit Vercel team permissions. Document who needs what secret. RECOMMENDATIONS (Priority order) 1. IMMEDIATE (today): Rotate DATABASE_PASSWORD, STRIPE_SECRET_KEY, JWT_SECRET — they were in git 2. TODAY: Update GitHub Actions workflow to use GitHub Secrets instead of .env file 3. THIS WEEK: Run git-filter-branch to scrub old commits, then force-push to main 4. THIS WEEK: Add git hook to prevent secrets commit: install pre-commit framework + detect-secrets plugin 5. ONGOING: Quarterly rotation schedule for all API keys. Document in README. RESOURCES NEEDED • git-filter-branch (comes with git) • detect-secrets Python package (for pre-commit hook) • Time: 90 min to fix + verify • Alertness: Monitor database/Stripe logs for suspicious activity next 72h
About this skill
"It works locally, but production says the key is missing." Or a credential turns up in an old commit, and deleting the file does not settle what to do next. This skill traces configuration to the running process, separates exposure from ordinary drift, and produces a prioritized fix or rotation plan without printing secret values.
What it does
- Checks tracked environment files, relevant Git history, build outputs, and logs for credential exposure using redacted findings.
- Compares required variable names, presence, types, environment scope, and loading rules across local, staging, and production.
- Diagnoses missing-variable incidents caused by empty values, overrides, build-time substitution, stale processes, or incorrect deployment targets.
- Plans credential replacement around affected consumers, overlap support, emergency revocation, verification, and safe rollback limits.
- Improves ignore rules, placeholder examples, startup validation, and deployment checks to prevent repeat incidents.
- Separates observed evidence, suspected exposure, completed changes, and verification still outstanding.
What you get
A focused diagnosis for a quick problem, or an evidence-based audit with prioritized findings and concrete remediation steps. Rotation requests include the consumer update order, revocation point, and checks needed to prove the replacement works and the exposed credential no longer does.
Best for
Developers and small engineering teams maintaining application configuration across local development, CI, staging, and production, especially after a leaked credential or an environment-related deployment failure.
SKILL.md preview
---
name: environment-secrets-audit-and-rotation
description: >-
Audit application environment variables for credential exposure and configuration drift, diagnose loading failures, and plan safe credential rotation using redacted evidence, consumer inventories, and explicit verification gates. Use when the user says "audit our env files", "I committed an API key", "my app keeps saying an environment variable is missing", "it works locally but fails in production", "compare staging and production configuration", "rotate this leaked credential", or "stop secrets from getting committed".
---
# Environment Secrets Audit and Rotation
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.