Field note
Staging secrets that never matched production
A recurring audit finding: staging credentials rotated on a different calendar than production, and why environment parity checks belong in the pipeline review.
Secret drift between staging and production is ordinary. What turns it into an incident is the belief that “staging passed” means the credential path is identical.
Patterns we keep seeing
- Staging uses a long-lived token in a shared vault path; production injects short-lived credentials through a different provider.
- A smoke test authenticates as a read-only user that does not exist in production.
- Rotation tickets close for production on Friday and for staging “next sprint,” which becomes never.
What an audit can do in a week
We do not claim to inventory every secret. We sample the paths your pipelines actually inject, compare naming and rotation evidence, and flag mismatches that would survive a green staging deploy. That sample is enough to brief a security counterpart without pretending we ran a full red-team engagement.
If compliance season is already on the calendar, book the audit early enough that remediations are not overnight YAML edits. Rushed secret changes create their own outages.