What problem does it solve? Credentials, keys, and tokens often end up hardcoded in source control, build artifacts, or logs, creating serious security exposure. This Skill defines a policy-driven discipline for managing every secret's lifecycle — storage, injection, rotation, and retirement — so no secret material leaks into repositories, pipelines, or logs. ## Core Features & Use Cases - Secrets Inventory & Policy: Maintains a complete inventory of every secret with owner, scope, storage location, and rotation schedule, plus injection policy favoring identity-based mechanisms. - Leakage Verification: Sweeps repositories (including history), build artifacts, images, configuration, and logs for secret material, routing confirmed exposures to defect management. - Rotation & Incident Response: Executes scheduled and emergency rotation, verifies consumer transition, and coordinates with incident management on confirmed exposure. - Use Case: When a code review flags a hardcoded API key, use this Skill to classify the finding, trigger immediate rotation, assess the impact window, and update the secrets inventory and policy. ## Quick Start Apply the Forge-Secrets-Management skill to build a secrets inventory and define storage, injection, and rotation policy for my new service and its CI/CD pipeline.
