[SECURITY] Quarterly Secret Rotation — 2026-04-01

[github-actions]

🔄 Quarterly Secret Rotation

Due: 2026-04-15

Secrets to Rotate

• Neo4j password — .env.vps, GitHub Secret

  1. Generate 24+ char password
  2. Update Neo4j: ALTER CURRENT USER SET PASSWORD FROM '...' TO '...'
  3. Update .env.vps on VPS
  4. Redeploy, verify DB connectivity

• Redis password — redis.conf, .env.vps

  1. Generate new password
  2. docker exec redis redis-cli CONFIG SET requirepass <new>
  3. Update .env.vps, redeploy

• GitHub Actions secrets

  • GITGUARDIAN_API_KEY
  • SONAR_TOKEN
  • DOCKERHUB_TOKEN
  1. Regenerate in each service dashboard
  2. Update in Settings → Secrets → Actions
  3. Trigger CI to verify

• VPS SSH key

  1. ssh-keygen -t ed25519 -f ~/.ssh/vps_new
  2. Add new pubkey to ~/.ssh/authorized_keys on VPS
  3. Update GitHub Secret: VPS_SSH_PRIVATE_KEY
  4. Test deploy, then remove old key

• External API keys (OpenAI, Anthropic, etc.)

  1. Rotate in provider dashboard
  2. Update .env.vps + GitHub Secrets
  3. Redeploy, verify

Post-Rotation

• All services healthy after rotation
• Old credentials revoked
• Documented in password manager