Hygiene & Rotation

$ ghostable hygiene report --env production
$ ghostable hygiene report --env staging --env production
 

The report checks configured variable rotation rules and environment-key age. Variable age is not treated as a problem by default because stable configuration such as APP_DEBUG=false does not require secret-style rotation.

Set a project default, then override it for a stricter environment:

$ ghostable hygiene rotation set --key STRIPE_SECRET_KEY --days 90
$ ghostable hygiene rotation set --env production --key STRIPE_SECRET_KEY --days 60
$ ghostable hygiene rotation list
 

Rules are stored in .ghostable/hygiene.yaml and use whole-day intervals. Remove one with hygiene rotation remove.

$ ghostable hygiene report --env production --unused
$ ghostable hygiene report --env production --stale-after 90d
 

Both checks are opt-in. Framework conventions, external platforms, reflection, and deploy scripts can consume environment keys without a direct source-code reference, so unused findings require human review.

Create a signed exception with the narrowest useful scope and an expiration:

$ ghostable hygiene suppress --code unused_variable --env production --key LEGACY_CALLBACK_TOKEN --reason "Read by external worker" --expires-in 30d
 

Use --include-suppressed when auditing all active findings and exceptions together.

Environment-key rotation is different from rotating an application credential. It re-encrypts the environment's key material and refreshes access for currently authorized identities.

$ ghostable hygiene rotate --env production --dry-run
$ ghostable hygiene rotate --env production --reason "Device revoked after offboarding"