{"id":"secret-rotation-automation","slug":"secret-rotation-automation","name":"Automated secret rotation for agents","shortName":"Secret rotation","problemStatement":"Rotate API keys, DB creds, and workload identities on a schedule with zero-downtime dual-publish so long-running agents do not die mid-job.","whenNotTopPick":"Need self-host/OSS (Infisical), AWS-native rotation Lambdas, or Vault already mandated.","categoryIds":["cat-auth-payments"],"depotPickProviderId":"doppler","depotPickRationale":"Distinct from `agent-secrets` (storage/injection). Here maturity of rotation workflows + DX. Confidence: high.","runnersUpIds":["infisical","aws-secrets-manager","hashicorp-vault","onepassword-secrets"],"weights":{"capabilityFit":0.2,"pricePerformance":0.12,"latencyReliability":0.28,"developerDx":0.14,"privacyPosture":0.08,"lockInRisk":0.08,"maturity":0.1},"methodologyNotes":"Distinct from `agent-secrets` (storage/injection). Here maturity of rotation workflows + DX. Confidence: high.","tags":["secrets","rotation","security","agents"],"depth":{"whenNotToUse":{"text":"Need self-host/OSS (Infisical), AWS-native rotation Lambdas, or Vault already mandated.","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"infisical","name":"Infisical","overallForJob":8.29,"pickOverallForJob":8.47,"beatsPickOn":["capabilityFit","privacyPosture","lockInRisk"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":5,"runnerUpLockInRisk":3.5,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":[],"runnerUpExitSignals":["self-hostable (provider tag `self-host`)","open source (provider tag `oss`)"],"pickNotes":[{"text":"Closed SaaS core (vs Infisical MIT self-host)","field":"weaknesses"},{"text":"Prefer Infisical when you need self-host or Agent Proxy that never hands raw credentials to the agent runtime.","field":"scores.notes"}],"selfHostFallback":[],"migration":"Runner-up Infisical has lower stored lock-in risk (3.5 vs 5, 0–10, higher = more lock-in).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"freshness":{"pick":{"score":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":2,"sourcesReachable":2,"pricingRows":5,"pricingRowsReconfirmed":3,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}}}}