Credential Rotation #

Define how a credential gets replaced. The Secure Identity Standard already says credentials should be short-lived; nothing says how to make one short-lived, or what to do when a specific one is exposed.

Legend: ✅ Complete | 🔄 In Progress | ⏳ Planned

Value objectives: Secure by default

• ✅ Exposed credentials rotated; every public repository scanned on push (CHG-0035) 2026-10-06
• ✅ Every long-lived credential listed, with what it unlocks and what uses it 2026-11-03
• ⏳ A written rotation procedure for each kind of credential, naming everything that must change with it
• ⏳ Static credentials assessed for short lifetimes, and the ones that cannot be shortened recorded
• ✅ A stated policy for what counts as an exposed credential and what happens next 2026-11-03

Project plan: Credential Rotation