Hygiene & Rotation | Ghostable CLI 3.x | Ghostable Menu Hygiene & Rotation Run a hygiene report -------------------- Hygiene reports Copy ``` $ ghostable hygiene report --env production $ ghostable hygiene report --env staging --env production ``` The report checks configured variable rotation rules and environment-key age. Variable age is not treated as a problem by default because stable configuration such as `APP_DEBUG=false` does not require secret-style rotation. Variable rotation rules ----------------------- Set a project default, then override it for a stricter environment: Rotation policy Copy ``` $ ghostable hygiene rotation set --key STRIPE_SECRET_KEY --days 90 $ ghostable hygiene rotation set --env production --key STRIPE_SECRET_KEY --days 60 $ ghostable hygiene rotation list ``` Rules are stored in `.ghostable/hygiene.yaml` and use whole-day intervals. Remove one with `hygiene rotation remove`. Unused and stale checks ----------------------- Opt-in checks Copy ``` $ ghostable hygiene report --env production --unused $ ghostable hygiene report --env production --stale-after 90d ``` Both checks are opt-in. Framework conventions, external platforms, reflection, and deploy scripts can consume environment keys without a direct source-code reference, so unused findings require human review. Suppress findings ----------------- Create a signed exception with the narrowest useful scope and an expiration: Hygiene suppression Copy ``` $ ghostable hygiene suppress --code unused_variable --env production --key LEGACY_CALLBACK_TOKEN --reason "Read by external worker" --expires-in 30d ``` Use `--include-suppressed` when auditing all active findings and exceptions together. Rotate environment keys ----------------------- Environment-key rotation is different from rotating an application credential. It re-encrypts the environment's key material and refreshes access for currently authorized identities. Environment-key rotation Copy ``` $ ghostable hygiene rotate --env production --dry-run $ ghostable hygiene rotate --env production --reason "Device revoked after offboarding" ``` Rotate after compromise or revocation Revocation prevents future authorized use of current repository state. Rotate affected environment keys promptly after a lost device, exposed automation token, or offboarding event so newly committed state no longer uses stale grants. Automation output ----------------- JSON and SARIF Copy ``` $ ghostable hygiene report --env production --json $ ghostable hygiene report --env production --sarif ``` Use JSON for custom policy checks and SARIF for security tooling that accepts standardized findings. On this page [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev) CLI 3.x [ CLI 3.x ](https://ghostable.dev/docs/3.x) [ Desktop ](https://ghostable.dev/docs/desktop) CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service Installation Documentation brew homebrew npm npx linux windows PATH version update Start a new project Getting Started setup seed dotenv owner initialize Adopt an existing project Getting Started existing env import authoritative source adopt Onboard a team member Getting Started join request approve roles offboarding pull request Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata Environments Core Concepts protected production preview staging push sync pull replace run mask-output Variables and promotions Core Concepts var promote copy context annotation key Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete Daily development workflow Workflows pull diff validate review clean daily Review and secret scanning Workflows scan sarif github suppress secrets drift Hygiene and rotation Workflows rotation stale unused suppression environment key Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files Validation Reference schema required nullable regex min max different\_from Command reference Reference --help --json NO\_COLOR flags aliases exit code automation Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model Backups & Offline Reference recovery offline restore clone key identity Agent integration Reference AGENTS.md capabilities allowlist coding agent Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics Ghostable Desktop overview Desktop Installation Desktop Projects and setup Desktop Interface tour Desktop Environments and variables Desktop Local environment files Desktop Validation and review Desktop Activity Desktop Access and automation Desktop Project settings Desktop Application settings Desktop Licensing and updates Desktop Security and storage Desktop Troubleshooting Desktop No results found