ラボ / Security
SecurityWorking~4h
Rotate a secret without anyone noticing
A small running service that starts with a hardcoded API key (the wrong way), which you migrate into a managed secret store with versioning. You then build the read-at-runtime path so the service pulls the current secret on every use, rotate the underlying secret while the service keeps serving traffic, and prove the old secret is dead and never appears in source or logs.
これが証明すること
面接で守れる一言。
履歴書の一言
Migrated a hardcoded application secret into a managed secret store, implemented runtime secret fetching with caching, and rotated the secret with zero downtime, verified by a git-history and log scan showing no plaintext secret exposure.
- Knows secrets don't belong in source control or logs, and can prove it, not just assert it
- Can rotate credentials without a deploy or an outage
- Understands secret versioning and the cutover window between old and new
- Builds the verification, not just the fix
概要
ステップごとに作るもの。
- 01Start with a service that authenticates an outbound call using a hardcoded API key in source — commit it once to establish the 'before' state.
- 02Move the secret into a secret manager with versioning enabled; strip it from source entirely.
- 03Implement runtime secret fetch with short-TTL in-memory caching so the service reads the current version without a restart.
- 04Rotate the secret in the store (create a new version, mark old as pending-deletion) while sending continuous traffic to the service; measure request success rate through the rotation window.
- 05Scan full git history and application logs for the old plaintext secret value to prove it was fully purged from source and never printed.
- 06Revoke the old secret version at the provider and prove requests using it now fail.
証明
これらが合格したら完了。
A git-history grep for the original plaintext secret returns zero matches after the purge commit
automated test
A log scan across the full rotation window returns zero occurrences of any secret value
automated test
Continuous request success rate stays ≥99% through the live rotation window (no restart, no downtime)
checked output
A request made with the revoked secret version is rejected by the provider after rotation completes
automated test
技術スタック
a secret manager (AWS Secrets Manager / GCP Secret Manager / Vault)a small HTTP service (Python or Node)gitstructured logging
Sage Method
frame → decide → prove
あなたが得るもの
A working service with runtime secret fetch + a rotation run report (success-rate log, git/log scan results)