Review secret management and rotation for stable release

[khoinguyenpham04]

This Roadmap discussion mirrors #1688: Review secret management and rotation for stable release.

Use this discussion to upvote the roadmap item and discuss priority, use cases, and product feedback. Keep implementation tracking, reproduction details, and PR-specific feedback on the source issue.

• Source issue: #1688
• Status: Open
• Labels: None
• Original author: ascorbic

Original Issue

Goal

Before 1.0, secrets used by previews, rate limits, plugins, and publishing should have a clear storage and rotation story.

Scope

Review preview secrets, IP salts, plugin secrets, registry/publishing credentials, and any attested publishing keys.

Acceptance criteria

• Each secret has documented source, storage location, and rotation behavior.
• Generated secrets have stable persistence where needed.
• User-provided secrets have clear environment variable or binding guidance.
• Rotation impact is documented, including what breaks if a key is lost.
• Tests or docs cover the critical production paths.