Appendix D · Rotation log template
The Secret Leak Field Manual · 2 min read
One row per credential rotation, kept in the same store as the key inventory (Chapter 9). The log answers three questions years later: what changed, when exactly, and who can vouch for it. Example rows use synthetic values only.
The log
| Date (UTC) | Credential | Provider / class | Masked value / fingerprint | Reason | Replacement created | Consumers migrated | Old revoked | Verified dead | Operator | Ticket / incident |
|---|---|---|---|---|---|---|---|---|---|---|
| 2026-03-04 | Marketing-site checkout | Stripe restricted (rk_live_) | rk_live_…XXXX / fp:9f21c | Scheduled quarterly | 2026-03-04 14:02 | 2026-03-04 15:20 | 2026-03-06 09:00 | Yes — request volume zero 24h; authenticated call rejected | A. Rivera | OPS-412 |
| 2026-05-11 | Support inbox sender | SendGrid scoped | SG.XXXX…9999 / fp:c40a1 | Key found in old contractor repo copy | 2026-05-11 10:47 | 2026-05-11 11:05 | 2026-05-11 12:30 | Yes — send test failed with revoked key as expected | J. Okafor | INC-087 |
| 2026-06-02 | CI deploy role | AWS IAM pair | AKIA…7Q2F / fp:55b0e | Migrating CI to OIDC federation (Ch. 9 stage 4) | n/a — role assumption replaces pair | 2026-06-01 18:00 | 2026-06-02 09:15 | Yes — CloudTrail shows no use since cutover | M. Lindqvist | SEC-233 |
Field notes
- Reason takes one of a fixed vocabulary so the log is countable later:
scheduled,rotation-after-exposure,staff-change,scope-reduction,provider-deprecation,migration. - Masked value / fingerprint: never the full value. If your tooling produces salted fingerprints, prefer them — they identify the credential without re-exposing it.
- Old revoked and verified dead are separate columns on purpose. Revocation you performed is not the same fact as revocation the provider enforced; the verification method goes in the notes column of your tracker if not here.
- Consumers migrated records when the last known consumer moved, which defines when the watch period starts.
- Watch period convention: revoke only after the old credential's request volume has been flat at zero for hours or days (per provider guidance — see Chapter 6), and record both numbers.
Cadence review
Quarterly, answer from this log:
- Which credentials have no rotation row older than their policy allows?
- Which rotations took longest between replacement-created and consumers-migrated? That gap is where downtime risk lives.
- Which reasons dominate?
rotation-after-exposureclustering in one family points at the structural fix to prioritize next (Chapters 7–9).