Key rotation drill
You already know what a key is (Harness 01/03). Prove rotation and no secrets in git.
00of 02 sections behind you
Rules (reminder only)
01
Audit
Where secrets live
02
Move
Env only
03
Rotate
Retest chat
04
Git clean
.env ignored
- Secrets only in env / secure store — never SOUL, MEMORY, briefs, or git
- Rotate on any chat/log leak
- Dev vs prod keys when the provider allows
If a key hit chat, rotate now. Editing history is not revocation.
Drill
Steps · tap the number to check0/4
- List every provider in keys-audit.md with where the secret lives.
- Move any secret that lives in a markdown note into env; rotate that key.
- Rotate the least-critical key on purpose; update Hermes; one successful chat.
- Confirm .env is gitignored in repos Hermes can write; git status.