Harness Lab · 04
Key rotation drill
You already know what a key is (Harness 01/03). Prove rotation and no secrets in git.
~20 min
Requires
Hermes running with at least one provider key
Assumes
You understand .env from mastery; this is audit + rotate practice.
If not ready: Harness 03 — Install →
01
Audit
Where secrets live
02
Move
Env only
03
Rotate
Retest chat
04
Git clean
.env ignored
Rules (reminder only)
- ·Secrets only in env / secure store — never SOUL, MEMORY, briefs, or git
- ·Rotate on any chat/log leak
- ·Dev vs prod keys when the provider allows
If a key hit chat, rotate now. Editing history is not revocation.
Drill
Steps · tap to check0/4
Outcome
keys-audit.md lists providers and secret locations; one key rotated and retested; git status clean of .env.
Proof · this device0/1
Stored on this device only — not sent anywhere.