Secret Inventory and Rotation Tracker
When a vendor says your keys may be exposed, the first question is what key is this? List the secrets you hold, see which have no owner, sit in plaintext, are stale, could be replaced by a role or are not restricted to trusted networks, and get an order to rotate them in. Rows stay in your browser.
Record facts about a secret, never the secret itself. Rows are saved only in this browser (local storage) and nothing is sent to a server. Clear all removes them.
Your secrets
No secrets yet. Add one, or import a CSV. Start with the keys you would rotate first if a vendor told you they were breached.
Rotation order
Points per flag: Plaintext 3, What key is this? No owner 3, Stale 2, Not network-restricted 2, Replaceable by a role 1, In env or config, not a manager 1. Highest total first. A planning model.
Name at least one secret to see the order.
Find secrets you have not listed
TruffleHog scans repositories for secrets. Flags can differ between versions, so check trufflehog --help before you run these.
# Scan the current repository history for verified secrets
trufflehog git file://. --only-verified
# Scan every repository in a GitHub organization
trufflehog github --org=<org> --only-verified
# Flags change between versions: check trufflehog --help and trufflehog git --helpTreat any finding as exposed: add it to the list above and rotate it, even if verification says it no longer works.
TL;DRWhat this tool is
5 points
- A table where you list the secrets you hold: name, type, owner, the system it unlocks, when it was created and last rotated, where it is stored, whether a role could replace it and whether it is network-restricted.
- It flags the ones nobody can name an owner for ("what key is this?"), plaintext copies, stale secrets, secrets a role or workload identity could replace, and secrets that are not network-restricted.
- It then gives a rotation order from the flags. The points per flag are shown on the page and are a planning model.
- It includes TruffleHog commands for finding secrets you have not listed yet, with a reminder to check the flags against your installed version.
- Rows are saved only in your browser. Record facts about a secret, never its value. You can clear everything, import a CSV and download one.
Reduce and manage secrets
magoo's second direction in his retrospective is to reduce and manage secrets: take an inventory (he points to TruffleHog for finding them), replace secrets with roles where you can, rotate the rest into a secrets manager, give each service only the secrets it needs, and restrict what remains to trusted networks. He also observed that many of the leaked keys could have been role-based credentials or used Workload Identity Federation. Those are his observations from the incidents he followed.
This tracker turns that list into a table you can work through. The columns map to the questions an incident asks: who owns it, what does it reach, where does it live, how old is it, could it be removed altogether, and would it still work from an attacker's network.
Sources
- magoo, “Black October: Lessons From the Downstream Breaches”, Starting Up Security, Oct 2026.
- TruffleHog documentation and
trufflehog --helpfor the version you run.
Frequently asked questions
Why track secrets by owner?
In "Black October: Lessons From the Downstream Breaches" (Starting Up Security, Oct 2026), magoo observed that many owners could not tell what a key was when it was leaked, which made rotation hard. If a key has no owner, nobody can say what breaks when it is rotated, so it tends to be left alone. An owner column makes that gap visible.
Should I enter the secret value?
No. The tracker only needs facts about the secret: what it is called, who owns it, what it unlocks, when it was last rotated and where it is stored. Never paste a secret value into this page or a CSV.
Where is my data stored?
In your browser's local storage on this device, and nowhere else. Clearing site data, using a private window or switching browser will lose it, so keep your own copy of anything important. The Clear all button removes the rows from this browser.
How does the rotation order work?
Each flag adds points: plaintext 3, no owner 3, stale 2, not network-restricted 2, replaceable by a role 1, kept in an environment variable or config file 1. Secrets with the most points come first. A secret with no dates counts as stale because you cannot show when it last changed. The stale threshold is yours to set. Replacing a key with a role is usually better than rotating it again; the flag tells you when that is possible.
Which TruffleHog flags are right?
The commands shown are the common forms for scanning a local git repository and a GitHub organization, limited to secrets TruffleHog can verify as live. Flags change between versions, so run trufflehog --help and trufflehog git --help on your installed version before you rely on them.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.