A secret rotation drill times how long it takes to list, revoke, reissue and verify the credentials a compromised dependency or pipeline could have read. Run it on a throwaway credential first, record each step's time, then fix whatever was slow.
Why drill rotation
After the tj-actions compromise, CISA's advice was to rotate identified secrets immediately because they should be treated as compromised. After the Shai-Hulud npm worm, CISA said to rotate all developer credentials. Both are easy sentences and hard jobs. Most teams discover during a real event that nobody knows where every secret lives.
The drill, step by step
Use a dummy credential for the first run, such as a test npm token or a sandbox cloud key.
- Inventory (target: 15 minutes). List secrets by location: repository, environment, organisation, developer laptop, cloud console. For each, record owner, scope and where it is used.
- Rank. Rotate the most powerful first: cloud admin keys, registry publish tokens, signing keys, then everything else.
- Revoke. For npm, the documentation says to list tokens with
npm token list, then delete by ID withnpm token delete, and list again to confirm. You must use the token ID, not the truncated token value. - Reissue. Create a replacement with the smallest scope that works and store it in your secret manager.
- Deploy. Update the pipelines or services that used it and watch for failures.
- Verify. Prove the old credential no longer works and the new one does.
# list tokens, then delete one by its ID
npm token list
npm token delete 123456
npm token list
Plan for delay
npm notes there may be a delay of up to an hour before a revoked token stops working. Your drill should record how you cover that gap: monitoring for use of the old token, restricting publishing at the organisation level, or pausing releases. Other providers have their own behaviour, so check each one's documentation and write the result in your runbook.
What to record
| Step | Target | Actual | Blocker |
|---|---|---|---|
| Inventory | 15 min | ||
| Revoke most powerful secret | 10 min | ||
| Reissue and deploy | 20 min | ||
| Verify old key is dead | 10 min |
Common blockers: a shared token nobody owns, a secret hard coded in a build script, a production service that breaks on rotation, and one admin who is on leave.
Make it routine
Rotation is easiest when it is boring. Short lived credentials, a secret manager with versioning, and one owner per secret turn an emergency into a ticket. Pair this drill with the monthly offline build drill and the kill switch drill and review results in your after-action report.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what continuous monitoring surfaces, and ask which of those signals would tell you an old secret was still in use.
Safeguard offers asset discovery and policy enforcement, which help build the inventory this drill starts from.
Quick check
Should we rotate real production secrets in a drill?
Start with dummy or sandbox credentials. Move to real ones only with a rollback plan, a quiet window and the owner present.
Which secret should be rotated first?
The one that grants the most power and the widest reach, usually cloud administrator keys and registry publish tokens.
Sources
- CISA alert on the tj-actions/changed-files and reviewdog compromise
- CISA alert on the widespread npm supply chain compromise
- npm documentation on revoking access tokens
Last reviewed: 19 October 2026.
