Loading…
32
Heard a senior dev say 'we block deploys over secrets but never audit who can read them' and it stuck with me
Was on a call with a security lead from a fintech company in Denver on Tuesday and he dropped that line about secrets management. He said his team spent 6 months locking down CI pipelines but nobody had checked the vault access logs in over a year. When they finally pulled the logs, 14 people had read prod database creds who shouldn't have had access since a reorg happened. Now I run a quick access review on our vault every quarter, takes about 20 minutes and has caught two stale service accounts so far. Anyone else doing periodic secret access checks or is it just me overthinking this?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.