Dynamic secrets give each application session its own short-lived database credential, while rotated static passwords replace one long-lived credential on a schedule. Dynamic secrets reduce reuse and leak impact but need more tooling. Rotation is simpler to adopt and a sensible first step.
What each approach means
The OWASP Secrets Management cheat sheet describes two ways to reduce human handling of secrets. With dynamic secrets, an application requests its database credentials at start up and receives newly generated ones for that session. Use a short lease duration and revoke the credential when it is no longer needed. With automated rotation of static secrets, a process changes a long-lived secret on a schedule.
| Aspect | Dynamic secrets | Rotated static secrets |
|---|---|---|
| Credential lifetime | Short, tied to a lease | Until the next rotation |
| Reuse across instances | Each instance gets its own | Shared by all instances |
| Leak impact | Limited by lease length | Until noticed and rotated |
| Attribution | Per session or per instance | One identity for the application |
| Setup effort | Needs a secrets system that can issue credentials | Needs a rotation process and application support |
| Application change | Must fetch credentials at startup or renewal | Must handle a changing password cleanly |
Why dynamic helps
The guidance says dynamic secrets should be used where possible to reduce the surface area of credential reuse. There is a detection benefit too. In the CI/CD section, OWASP notes that when a secret is dynamic and tied to one consumer, use of it from anywhere other than the consumer's IP is easy to detect.
A caveat from the same source deserves emphasis: restarting an application does not itself revoke stolen credentials. They stay usable until the backing service expires or revokes them. So the lease and revocation behavior is the control, not the restart. Tie invalidation to lease expiry or explicit revocation.
Why rotation is still valid
Many teams cannot start with dynamic credentials. Legacy services, third party tools and reporting software may need a fixed password. OWASP's guidance says manual maintenance increases the risk of leakage and error, so automate rotation or at least ensure the process is well supported.
It lists strategies for rotating keys, including gradual rotation, where new keys are used for writes while old keys remain for reads, and rapid rotation, plus scheduled rotation. For passwords you can run a similar overlap: create the new credential, update consumers, confirm, then revoke the old one.
How to choose
- Start by inventorying which services use which database credentials. Use per service credentials first, as covered in our post on separate credentials.
- For new services on a platform whose secrets system can issue database credentials, choose dynamic.
- For services that cannot fetch credentials at runtime, rotate on a schedule and test the process.
- For both, give the database role the least privilege the service needs. A reporting job needs reads, not writes.
- Log credential issuance, use and revocation.
Operational traps
- Connection pools. Make sure the application renews or rebuilds connections when credentials expire.
- Long running jobs. Align the lease with the longest job or support renewal.
- Secrets system availability. OWASP says the secrets service must be highly available, because applications depend on it at start up. If it is down, services may fail to start. Plan break-glass and restore tests.
- Humans. Do not let engineers keep a permanent personal copy of a production database password.
Rotation after exposure
If a credential is exposed, the same guidance calls for immediate revocation, quick creation of a new secret through an automated process, and removal of the old one from the exposed system. Dynamic secrets make this smaller, since the blast radius is one session.
Where Safeguard fits
Safeguard does not issue credentials. Its dependency scanning and reachability analysis cover the database drivers and libraries around them, and its policies and gates add checks at the pull request. A free scan is available at gold.safeguard.sh/scan.
Quick check
Do dynamic secrets remove the need for rotation?
They replace long-lived credentials with short leases. You still need revocation and a plan for the secrets system itself.
What if my application cannot fetch credentials at runtime?
Use automated rotation with an overlap period, and test that the application handles the change.
Sources
Last reviewed: 19 October 2026.
