Vaults prevent some leaks. Scanners catch the rest.

Vaults protect values at rest; bundles prove what shipped. The mature setup uses both — comparison inside.

2026-08-234 min read

What Secret managers / vaults does well

centralized storage, rotation ergonomics, audit trails for server-side consumption.

Single rotation point.
Access logging per consumer.

What Bundle verification adds

confirms client output stayed clean regardless of upstream hygiene.

Vaults secure distribution to servers; they cannot stop a developer referencing values client-side, nor substitution publishing them. Verification closes the loop vaults structurally cannot see past.

Rotation without redeploy sprawl.,Least-privilege broker patterns.

Truth about final artifacts.
Catches integration-time mistakes.
V
a
u
l
t
e
v
e
r
y
t
h
i
n
g
s
e
r
v
e
r
-
s
i
d
e
;
v
e
r
i
f
y
b
u
n
d
l
e
s
c
o
n
t
i
n
u
o
u
s
l
y
s
o
i
n
t
e
g
r
a
t
i
o
n
m
i
s
t
a
k
e
s
s
u
r
f
a
c
e
i
n
h
o
u
r
s
,
n
o
t
q
u
a
r
t
e
r
s
.

Using them together

Storing new secrets? Vault first.,Proving hygiene externally? Scanner evidence.

Decision rule

Keep what already works for its stated strength.
Add KeyDrift when the deployed artifact itself needs watching.

Neither answer replaces the other; they watch different files at different moments. The mistake is believing one report covers both.

Why this keeps happening industry-wide

Zoom out and the pattern is bigger than one repo. AI-assisted output has outgrown review capacity everywhere at once, which means thousands of teams are making the same reasonable-looking tradeoffs in the same week. Nobody using modern tooling is uniquely exposed. The failure mode documented above is the modal outcome of velocity without verification, not evidence of carelessness.

How KeyDrift reports this exact finding

Report anatomy matters during incidents, so it is worth reading once calmly: masked string (never the live value — it ceases to exist outside the detection engine), salted fingerprint (trackable within your workspace, useless to strangers), chunk path (your starting point for a "git log -S" hunt), disposition (secret versus public-by-design), confidence (matches below 0.5 never reach the page at all).

Manual check, step by step

The full manual drill, for readers who want zero dependence on any tool: open the deployed site in a private window; launch DevTools → Sources; use Search-all-files (Ctrl/Cmd+Shift+F) for eyJ; then repeat for the other marker families — eyJ, sk_live_, sk-proj-, AKIA, postgres, BEGIN PRIVATE KEY. Decode anything JWT-shaped before reacting, and classify public-by-design formats as expected guests rather than intruders.

Close the loop with monitoring

If you take one operational step from this page, make it this: put the URL under continuous monitoring (free tier covers one project daily). The first scan tells you whether you have a problem today; the schedule tells you whether the problem comes back next month after someone re-adds the convenient line.

What the plans change

Free $0 — 1 project · daily scans · email alerts · findings always visible.
Indie $29/mo — 3 projects · hourly · Slack added · 80 chunks per scan.
Team $89/mo — 15 projects · every 15 minutes · Discord + webhooks · 150 chunks.
Growth — from $249/mo, quoted display-only until checkout ships.

The constant across every tier: plans limit how much is watched, never what a scan found. Visibility is structural, not promotional — asserted by tests over the entitlements model itself.

Common questions

Is Secret managers / vaults bad practice then?

No — the page credits exactly where it wins. Blind spots are structural, not sloppy.

Bottom line?

Add KeyDrift when the deployed artifact itself needs watching.

Run a free scan at keydrift.dev/scan — paste a URL or the bundle source itself, no account. Findings arrive masked, with the exact chunk they live in.