Harness Lab · 04
Key rotation drill
You already know what a key is (Harness 01/03). Prove rotation and no secrets in git.
~20 min
Requires
Hermes running with at least one provider key
Assumes
You understand .env from mastery; this is audit + rotate practice.
If not ready: Harness 03: Install →
Rules (reminder only)
01
Audit
Where secrets live
02
Move
Env only
03
Rotate
Retest chat
04
Git clean
.env ignored
- Secrets only in env / secure store: never SOUL, MEMORY, briefs, or git
- Rotate on any chat/log leak
- Dev vs prod keys when the provider allows
If a key hit chat, rotate now. Editing history is not revocation.
Drill
Steps · tap to check0/4
Outcome
keys-audit.md lists providers and secret locations; one key rotated and retested; git status clean of .env.
Proof · this device0/3
Stored on this device only, not sent anywhere.