Die Labs / Security
SecurityWorking~4h
Rotate a secret without anyone noticing
A small running service that starts with a hardcoded API key (the wrong way), which you migrate into a managed secret store with versioning. You then build the read-at-runtime path so the service pulls the current secret on every use, rotate the underlying secret while the service keeps serving traffic, and prove the old secret is dead and never appears in source or logs.
Was er beweist
Der Satz, den du im Vorstellungsgespräch verteidigen kannst.
Lebenslauf-Zeile
Migrated a hardcoded application secret into a managed secret store, implemented runtime secret fetching with caching, and rotated the secret with zero downtime, verified by a git-history and log scan showing no plaintext secret exposure.
- Knows secrets don't belong in source control or logs, and can prove it, not just assert it
- Can rotate credentials without a deploy or an outage
- Understands secret versioning and the cutover window between old and new
- Builds the verification, not just the fix
Die Aufgabenstellung
Was du Schritt für Schritt baust.
- 01Start with a service that authenticates an outbound call using a hardcoded API key in source — commit it once to establish the 'before' state.
- 02Move the secret into a secret manager with versioning enabled; strip it from source entirely.
- 03Implement runtime secret fetch with short-TTL in-memory caching so the service reads the current version without a restart.
- 04Rotate the secret in the store (create a new version, mark old as pending-deletion) while sending continuous traffic to the service; measure request success rate through the rotation window.
- 05Scan full git history and application logs for the old plaintext secret value to prove it was fully purged from source and never printed.
- 06Revoke the old secret version at the provider and prove requests using it now fail.
Der Beweis
Fertig, wenn diese Tests bestehen.
A git-history grep for the original plaintext secret returns zero matches after the purge commit
automated test
A log scan across the full rotation window returns zero occurrences of any secret value
automated test
Continuous request success rate stays ≥99% through the live rotation window (no restart, no downtime)
checked output
A request made with the revoked secret version is rejected by the provider after rotation completes
automated test
Stack
a secret manager (AWS Secrets Manager / GCP Secret Manager / Vault)a small HTTP service (Python or Node)gitstructured logging
Sage Method
frame → decide → prove
Du behältst
A working service with runtime secret fetch + a rotation run report (success-rate log, git/log scan results)