RPA bots should fetch credentials at run time from a managed secret store with access control and audit logging. Passwords should not sit inside workflow files, config exports, shared drives or spreadsheets. Each bot should be able to read only its own secrets, and secrets should expire or rotate.
Why workflow files are a poor place for secrets
Workflow files get copied, exported, emailed to a vendor for support, and checked into folders many people can read. A password typed into a step becomes a password in every copy. The OWASP Secrets Management Cheat Sheet notes that many organizations have secrets hardcoded in source code in plaintext or scattered through configuration files, and calls for centralised storage, provisioning, auditing and rotation.
What a good setup has
- A central store that holds credentials, with its own access control.
- A bot reads only the secrets it needs. The cheat sheet states that secrets must have the minimum privileges needed for their role.
- Every read is logged, and the log resists tampering or deletion. The cheat sheet says auditing must be implemented so it is resilient against that.
- Secrets expire after a defined time where possible.
- Revocation is quick, and unused or suspect secrets are revoked.
- Bot logs and screenshots never contain the secret.
Many RPA platforms have a built in vault
Most platforms include a credential store or connect to an external one. Prefer whichever one your security team can already monitor. Check four things before you rely on it: who can read a stored value in clear text, who can edit the bot that uses it, whether reads are logged, and whether you can rotate without editing workflows.
That second point catches people out. If a person can edit a bot, they can often make it print or send the secret it fetches. Control who may change production workflows, not just who may see the vault.
Screenshots and logs
Bots that capture screens for troubleshooting can capture a password field or a customer record. Decide whether capture is needed, mask sensitive fields where the tool allows it, and limit who can read the captures. Treat run logs as data that may need the same protection as the systems the bot touches.
A quick audit you can do this week
- Search workflow exports and shared folders for the word password and for key prefixes you know your vendors use.
- Ask each bot owner where their bot's credentials live, and write the answer down.
- Pick one bot and time how long a rotation takes. If the answer is days, fix that first.
If you find a live secret in a place it should not be, treat it as exposed: revoke it and issue a new one, rather than just deleting the file.
Where Safeguard fits
Safeguard does not offer secret scanning, and it is not a vault. It can help with the code around your automation: SBOM and dependency scanning for custom scripts, and asset discovery to find where automation runs.
Quick check
Is it acceptable to store a bot password in the orchestrator or control room?
If it is the platform's credential store with access control and logging, it is a reasonable choice. Plain text in a workflow step is not.
How often should bot credentials rotate?
Set a defined lifetime and shorten it for sensitive systems. The key test is whether you can rotate without editing workflows.
Sources
Last reviewed: 19 October 2026.
