Ghostdrive

News · Academy · November 12, 2026

Academy: secrets, and how to rotate them after an incident

Keys in env files were the loot in ChainDrop and Railway. Where to keep secrets, and the order of steps when one leaks: revoke first, then clean up.

DRIVE 369 DAO · 2 min read

Academy, organisations, lesson 10. Every system runs on secrets: API keys, database passwords, tokens. They are the most valuable thing an intruder can read, and the last thing most teams inventory.

Why

The ChainDrop npm worm searched laptops, shell histories, cloud settings and build-server memory for keys, then used them against npm, GitHub, AWS and Kubernetes (Microsoft). At Railway in October, part of customers' stored environment variables was decrypted, and users were asked to rotate everything they kept that way (briefing). After PHP2Shell, the advice from Wordfence was to rotate database passwords and keys that the web server could read.

Where secrets should and should not live

  • Not in code, shell history or chat. Not in a file in the project folder.
  • Not forgotten in old environments. Every copy is another place to lose it.
  • In a secrets manager, with access logged, and fetched at run time rather than baked in.
  • Short-lived where you can. The OWASP Secrets Management Cheat Sheet recommends dynamic secrets with short leases and platform identity, such as OIDC, over static keys in build pipelines.

When one leaks: the order matters

From OWASP and GitHub's guidance:

  1. Revoke first. Rewriting history does not help while the key still works. Restarting an application does not revoke a stolen credential either.
  2. Rotate to a new secret, automatically if you can.
  3. Find the use. Check logs for who used it and when. Responders need to know who had it, when it was used and when it was last rotated.
  4. Then clean up. Remove it from code and logs. On GitHub, delete it from history with a tool such as git-filter-repo, and remember that forks, clones and pull requests may still hold a copy, which is another reason to revoke first.
  5. Look for what it opened. A cloud key may have created new users or keys. Remove those too.
  6. Write it down so the next rotation is faster.

A rotation list

For each secret: what it opens, where it lives, who owns it, how to replace it, and when it was last changed. Ten minutes to make, hours saved on the day.

How Ghostdrive approaches it

Pass stores API secrets and SSH keys as sealed items, each with its own key, with titles and websites encrypted too. Copies clear from the clipboard after 30 seconds, and a Watchtower view flags weak, reused and old passwords. It is a manager for people and small teams. For production secrets at scale, use the manager your platform provides, and keep the master copies out of environment files.

Academy: start here · ChainDrop briefing · Supply chain hygiene