🔐 Security Kit — Secret Rotator Demo

• Automated rotation — rotate secrets based on configurable max-age policies (default: 90 days)
• Provider hooks — built-in support for Stripe, generic API keys, and password generation
• Rollback on failure — automatic backup and restore if rotation fails
• Age checking — scan all secrets and flag stale credentials with `--check-age`
• Secure backups — HMAC-verified backup before every rotation
• Cryptographic generation — secrets generated via Python's `secrets` module (CSPRNG)

# Rotate all secrets that exceed their max age
python src/secret_rotator.py --config secrets.json --rotate

# Check which secrets are stale
python src/secret_rotator.py --config secrets.json --check-age

# Roll back a specific secret to its previous value
python src/secret_rotator.py --config secrets.json --rollback api-key-prod

{
    "secrets": [
        {
            "name": "STRIPE_API_KEY",
            "provider": "stripe",
            "max_age_days": 90,
            "current_value": "sk-EXAMPLE...",
            "last_rotated": "2026-01-15T00:00:00Z"
        },
        {
            "name": "DB_PASSWORD",
            "provider": "password",
            "max_age_days": 60,
            "length": 32,
            "charset": "alphanumeric_special"
        }
    ]
}