Move a hardcoded credential into the secret manager
A credential stored in the repository, moved to the secret manager, replaced, and checked at startup.
The ticket
Move a hardcoded credential into the secret manager, rotate it, and confirm the service reads the new reference.
Acceptance criteria
- The value is gone from the working tree and from configuration
- The service reads it from the secret manager at runtime
- A boot check fails loudly when it is missing, rather than falling back to a default
- The old value is rotated and the rotation is recorded
What lands as proof
A clean secret scan, and a boot check that refuses to start when the reference is absent.
Why teams defer it
- Rotating means coordinating a deploy, and coordinating a deploy means finding a window.
- The value is usually in more places than the first search shows: a test fixture, an old runbook, a CI variable somebody set two years ago.
- Everything works today, so from the approver's side the change is all downside.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: move a hardcoded credential into the secret manager, rotate it, and confirm the service reads the new reference. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means scanner clean and a boot check that reads the new reference, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops for the plan, and the review bar is raised afterwards so that smaller suggestions block the merge too, not only serious findings.