Selected work
Credential broker & rotation
Centralised, automated secret rotation across a multi-vendor device fleet with an encrypted vault.
Problem
Shared credentials across a large, mixed device fleet are a standing risk: manual rotation is error-prone, easy to skip, and a single stale password can lock out operations or open a hole.
Approach
A broker holds secrets in an encrypted vault and exposes them to consuming services over an allow-listed API with local caching and fallback. Rotation runs as a two-phase commit with anti-lockout safeguards across Linux, BSD and network devices; every change is notified, and the rotation endpoint is reachable only from localhost.
Stack
Outcomes
- One source of truth for credentials instead of scattered copies
- Hands-off rotation with anti-lockout and rollback safety
- Whole-fleet enrollment with scheduled, automated rotation
- Notifications on every rotation, with privileged access bound to localhost