Critical Infrastructure Operator

The client's codebase contained dozens of hardcoded credentials — database passwords, third-party API keys, internal service tokens — spread across .env files committed to git, CI secrets configured in the UI without documentation, and a Slack channel that had been used to share credentials "temporarily" for two years.

We scanned the full codebase and CI configuration first, cataloguing every secret by type and access scope. The scan surfaced 47 distinct credentials across 12 services. We prioritised by blast radius: database credentials and cloud API keys first, internal tokens last.

Vault was deployed in HA mode with AWS KMS-backed auto-unseal. We wrote Terraform modules for provisioning policies and roles so that every new service got a least-privilege secret path by default. GitHub Actions was wired to use Vault's JWT auth — no static credentials in CI at all.

The migration took four weeks. By the end every credential was in Vault, rotation was automated on a per-secret schedule, and every access was logged. A final scan confirmed zero plaintext credentials in the codebase. The audit trail the client had never had was now on by default.