Skip to content

[REVIEW] secrets-management: add bootstrap secret-zero and recovery evidence gates #1577

@wangedmund77-cmyk

Description

@wangedmund77-cmyk

Skill Being Reviewed

Skill name: secrets-management
Skill path: skills/devsecops/secrets-management/SKILL.md

False Positive Analysis

Benign code/configuration that can be over-flagged:

workload_identity: enabled
secret_manager: vault
bootstrap: OIDC exchange scoped by repository, branch, and environment

Why this is a false positive:
workload_identity: enabled can be safe when the missing compensating evidence is present, but the current skill does not ask reviewers to distinguish that evidence from the risky pattern. The review should require proof of the guardrail before escalating severity.

Coverage Gaps

Missed variant 1:

VAULT_TOKEN=$(cat /var/run/bootstrap-token)
# long-lived token baked into image to fetch all other secrets

Why it should be caught:
This variant leaves a realistic attack path open while still satisfying the current high-level checklist language.

Missed variant 2:

break_glass_password stored in runbook.pdf
# rotation owner and test evidence missing after incident recovery

Why it should be caught:
This is a common production edge case where policy exists on paper but does not bind the runtime behavior or evidence trail.

Edge Cases

Secret managers still need a bootstrap identity. Reviews often credit centralization while missing how the first credential is provisioned, rotated, and recovered after compromise.

Remediation Quality

  • Fix resolves the vulnerability
  • Fix doesn't introduce new security issues
  • Fix doesn't break functionality
  • Issues found: Add evidence gates for secret-zero source, workload identity constraints, bootstrap token TTL, recovery/break-glass custody, rotation test evidence, and revocation after failed bootstrap attempts.

Comparison to Other Tools

Tool Catches this? Notes
TruffleHog/Gitleaks No Find exposed material, not bootstrap architecture.
Cloud IAM analyzers Partial Can validate federation constraints if configured.
Vault audit logs Partial Show usage but not recovery design by themselves.

Overall Assessment

Strengths:
The skill covers storage, scanning, and rotation basics well.

Needs improvement:
Bootstrap identity and recovery paths need first-class review because they are often the highest-value secret path.

Priority recommendations:

  1. Add a secret-zero section for OIDC/workload identity, long-lived bootstrap tokens, and image-baked credentials.
  2. Require break-glass custody, test, and post-use rotation evidence.
  3. Distinguish centralized secret storage from proven least-privilege retrieval.

Bounty Info

  • I have read and agree to the CONTRIBUTING.md bounty terms
  • Preferred payment method: Crypto or PayPal after maintainer acceptance.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions