Rotation inventory
Working list of keys and credentials that need rotation, ownership, and a calendar. Priorities reflect typical risk (production paths and data access first). Schedules are TBD until platform and product leads sign off.
Rotation inventory
Section titled “Rotation inventory”Sorted high → medium → low. Production-tier secrets are the most urgent to rotate on a calendar.
| Key / credential | Where it lives | What it protects | Priority | Proposed schedule | |
|---|---|---|---|---|---|
Fly deploy token (FLY_API_TOKEN) | GitHub Actions — per environment (staging / UAT / production Fly org) | Ability to deploy and change apps in that Fly org; production token can alter live code and read runtime secrets | High | TBD | |
MongoDB connection (MONGODB_URI, DB users) | Fly secrets — per app | Application data in Atlas (customer and business records) | High | TBD | |
Auth / identity (AUTH0_*, etc.) | Fly secrets — per repo (Auth0) | User login, API authorization, account lifecycle | High | TBD | |
| AWS IAM / access keys (where still used) | AWS — roles or keys per service | Shared AWS resources, storage, and enterprise integrations | High | TBD | |
App-specific secrets (see each .env.example) | Fly secrets | Third-party APIs, payments, webhooks—impact varies by vendor | High | TBD | |
Cloudflare tunnel token (CLOUDFLARE_TUNNEL_TOKEN) | Fly secrets — per app | Tunnel registration; misuse can change what is reachable on the org tunnel | Medium | TBD | |
Sentry deploy token (SENTRY_AUTH_TOKEN) | GitHub Actions — repository secret | Source map upload and release metadata at build time (exposes code structure) | Medium | TBD | |
| MongoDB Atlas IP access rules | Atlas Network Access — per Fly egress IP | Network path to the database; misconfiguration can block or over-expose access | Medium | TBD | |
Sentry runtime (SENTRY_DSN, SENTRY_ENVIRONMENT) | Fly secrets — per app / tier | Live error and performance reporting (mostly ingest; limited read of other tenants) | Medium | TBD | |
| Grafana Cloud (stack / API access) | Platform — collectors, not in app repos | Org-wide logs and metrics ingestion | Low | TBD | |
Sentry org / project (SENTRY_ORG, SENTRY_PROJECT) | GitHub Actions (secret or variable) | Project identifiers for CI uploads—not secret material on their own | Low | TBD |
Related
Section titled “Related”- Naming conventions — naming for Fly apps and Mongo IP rules
- Timeline — secondary SDLC plan with key rotation on the roadmap
- GitHub · Fly checklist — minimum secrets for deploy