Build logs are the most-read documents in an engineering organization and the least protected. Everyone with repository access can read them, they are retained for months, and they are where credentials go to be forgotten. This post is about the three changes that stopped secrets from reaching ours.
Secrets reach logs by three routes. A developer prints the environment to debug a failing job. A tool echoes its arguments on error, and one of the arguments is a token. Or a library logs a request, headers included. Masking patterns in the CI product catch the obvious shapes and miss everything else, because a token that does not look like a token is still a token.
Our first change took the secrets out of the environment entirely. A job now asks the Control Gateway for a credential at runtime; the Audit Vault issues one scoped to the single system the job talks to, valid for as long as the job runs. A credential that leaks into a build log is already dead by the time anyone reads the log.
The second change was ownership. Every secret in the Audit Vault has an owner, a purpose and a rotation schedule. When a job starts failing because a credential rotated, the owner is a person, not a channel of four hundred people. Rotation went from an annual event nobody wanted to run to a Tuesday routine the Evidence Engine schedules itself.
The third change was the cheapest: scan the logs. Not with regular expressions for known shapes, but by hashing every secret in the Audit Vault and checking log lines against the hashes. A match means a credential reached a log, and the response is automatic: rotate it, notify the owner, record the event. In the first month we found eleven. In the last six, none.
The same approach applies to anything that handles transaction records in batch. Exports, migrations and backups run under short-lived credentials with a named owner, and the evidence of each run lands next to the access decisions in the audit log.
If your pipelines still carry long-lived credentials, the Audit Vault is where we would start. Talk to an engineer about the first job to convert.