Group
  • Deployment

    Rotate my production secrets safely

    Walks through rotating every API key, database credential, and signing secret with zero downtime, and sets a rotation cadence.

    • Plan & validate
    • Automate workflows
    • Intermediate
    • General

Free Prompt

Help me rotate all my production secrets safely and set up a rotation schedule. 1. Inventory: list every secret my production app uses: database credentials, API keys (payment, email, AI, third-party services), session/JWT signing secrets, webhook signing secrets, encryption keys, and OAuth client secrets. Note where each lives (platform env vars, secrets manager) and what breaks if it changes. 2. Rotation procedure per secret: for each one, give me the safe rotation steps. The pattern matters: secrets that support two active values at once (create new, deploy, revoke old) rotate with zero downtime. Secrets that only allow one value (many database passwords) need either a brief maintenance window or a create-secondary-user approach. Tell me which pattern applies to each secret on my list. 3. Signing secrets: for JWT/session secrets, explain the graceful approach (accept old and new for one session lifetime, then drop old) versus the hard cutover (everyone gets logged out) and let me pick. Implement dual-accept if my framework supports it. 4. Do the rotation: walk me through rotating the highest-risk secrets now: anything that has ever been in a git history, a screenshot, a log, or shared with a contractor or AI tool. 5. Schedule: set a recurring calendar reminder for routine rotation (quarterly for API keys, immediately on any suspected exposure) and document the rotation runbook so future rotations are boring. Do not rotate encryption keys that protect existing encrypted data without a re-encryption plan; flag those separately. Do not revoke the old value before confirming the new one works in production. Give me: the secret inventory with rotation pattern per secret, the executed rotations, the dual-accept implementation if applicable, and the runbook.

What This Does / How This Helps

Rotates every production secret using the right zero-downtime pattern per secret type, and sets the schedule so it happens again on time. Secrets leak in boring ways: a key committed to git six months ago, a database URL pasted into an AI chat, credentials shared with a contractor who finished in March. Rotation is the only fix, and the reason nobody rotates is fear of taking the site down, which is exactly what happens when you revoke the old key before the new one is deployed. The prompt inventories your secrets, maps each to its safe rotation pattern, handles the tricky ones like session signing with dual-accept, and turns the whole thing into a runbook with a calendar reminder.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts