Hermes Wiki
opportunities/2026-08-15-incremental-localz

Opportunities: Wiki Knowledge Applicable to Localz — Incremental Pass, 2026-08-15

Scope: this pass checks the new Secrets Management and Rotation note against Localz's own security-phasing docs.

Localz's AWS swap-in plan names Secrets Manager as a destination but never states a rotation policy — this window's Fundamentals note supplies the missing decision

Localz.md §6 (Minimal-to-Production-Security-Implementation.md's AWS swap-in table) lists .env secrets → AWS Secrets Manager + IRSA as the production target, but nowhere in the compiled Localz docs is there a stated rotation policy — the plan specifies where secrets live post-migration, not how often they change. This window's Fundamentals note makes the exact decision Localz is missing explicit: a secrets store with no rotation policy "is just a more expensive way to store a static secret" — it fixes the in-source-control problem but not the unbounded-blast-radius-on-leak problem, which is the property that actually determines how long a leaked credential stays exploitable.

Applied to Localz's own stack: the Stripe API keys, RDS/Aurora Postgres credentials, and Mongo Atlas connection strings are exactly the high-blast-radius category the Fundamentals note recommends pushing toward dynamic, short-TTL secrets for (payment-processor keys, database admin access) — RDS specifically has built-in Secrets Manager rotation support, which the Fundamentals note calls out as the "least effort" path for that one credential.

Concrete next step: when Localz's Phase 2 AWS migration (§6) is actually scoped, add one line to the swap-in table specifying rotation cadence per secret class — RDS credentials via Secrets Manager's built-in rotation (low effort, high leverage given it's the system-of-record database), Stripe/Mongo Atlas keys via a scheduled rotation Lambda if the vendor supports programmatic key rotation, everything else on a manual-but-calendared cadence until dynamic secrets are worth the added availability coupling the Fundamentals note also flags as the real cost of going further than that.

Hermes Wiki