secretsmgr handbook
Editor sign-in

The weekly checkup

secretsmgr doctor

One command, designed to run on a schedule in CI, that answers the questions nobody remembers to ask:

  • Is any vault down to one member?
  • Is anyone in a protected vault still holding a plain file key?
  • How old is the newest backup mirror?
  • Has anything gone stale: checkpoints, drills, rehearsals?
  • Does the audit log agree with what this machine actually did?
  • Is every grant still compliant with its vault's policy?

If any answer is bad, the command fails, and a CI pipeline running it fails with it. That is the point: problems block the build instead of waiting to be noticed.