Hygiene & Rotation

Workflows

Hygiene & Rotation

Track secrets that need attention, encode rotation expectations, suppress reviewed exceptions, and rotate environment encryption keys after access changes.

Run a hygiene report

Hygiene reports
$ ghostable hygiene report --env production
$ ghostable hygiene report --env staging --env production
 

The report checks configured variable rotation rules and environment-key age. Variable age is not treated as a problem by default because stable configuration such as APP_DEBUG=false does not require secret-style rotation.

Variable rotation rules

Set a project default, then override it for a stricter environment:

Rotation policy
$ ghostable hygiene rotation set --key STRIPE_SECRET_KEY --days 90
$ ghostable hygiene rotation set --env production --key STRIPE_SECRET_KEY --days 60
$ ghostable hygiene rotation list
 

Rules are stored in .ghostable/hygiene.yaml and use whole-day intervals. Remove one with hygiene rotation remove.

Unused and stale checks

Opt-in checks
$ ghostable hygiene report --env production --unused
$ ghostable hygiene report --env production --stale-after 90d
 

Both checks are opt-in. Framework conventions, external platforms, reflection, and deploy scripts can consume environment keys without a direct source-code reference, so unused findings require human review.

Suppress findings

Create a signed exception with the narrowest useful scope and an expiration:

Hygiene suppression
$ ghostable hygiene suppress --code unused_variable --env production --key LEGACY_CALLBACK_TOKEN --reason "Read by external worker" --expires-in 30d
 

Use --include-suppressed when auditing all active findings and exceptions together.

Rotate environment keys

Environment-key rotation is different from rotating an application credential. It re-encrypts the environment's key material and refreshes access for currently authorized identities.

Environment-key rotation
$ ghostable hygiene rotate --env production --dry-run
$ ghostable hygiene rotate --env production --reason "Device revoked after offboarding"
 

Automation output

JSON and SARIF
$ ghostable hygiene report --env production --json
$ ghostable hygiene report --env production --sarif
 

Use JSON for custom policy checks and SARIF for security tooling that accepts standardized findings.

CLI 3.x introduction Documentation
Installation Documentation
Start a new project Getting Started
Adopt an existing project Getting Started
Onboard a team member Getting Started
Repository and storage Core Concepts
Environments Core Concepts
Variables and promotions Core Concepts
Access and devices Core Concepts
Daily development workflow Workflows
Review and secret scanning Workflows
Hygiene and rotation Workflows
Automation credentials Automation & CI
Continuous integration Automation & CI
Deployments Automation & CI
Validation Reference
Command reference Reference
Configuration Reference
Security Reference
Backups & Offline Reference
Agent integration Reference
Troubleshooting Reference
Ghostable Desktop overview Desktop
Installation Desktop
Projects and setup Desktop
Interface tour Desktop
Environments and variables Desktop
Local environment files Desktop
Validation and review Desktop
Activity Desktop
Access and automation Desktop
Project settings Desktop
Application settings Desktop
Licensing and updates Desktop
Security and storage Desktop
Troubleshooting Desktop
No results found