Secret Rotation Policy

Policy

1. Secure Storage: Secrets must be stored securely in encrypted formats. Learn more about GitHub Action secrets here.

2. Regular Rotation: All secrets, including passwords, API keys, and access tokens, must be rotated at least every 90 days or according to the guidelines provided by the respective service providers such as Forest Client API.

3. Notification and Alerts: Set up notification and alert system to inform relevant stakeholders about upcoming secret rotations and possible application outages.

4. Documentation: Maintain clear documentation outlining the procedures for secret rotation.

5. Incident Response: Having procedures in place to handle any security incidents related to secrets, including procedures for revoking compromised secrets and implementing corrective measures.

6. Continuous Improvement: Regularly review and update the secret rotation policy