Secrets Distribution Service  ·  View 05 of 34  ·  2 · People and journeys

Journey — Contain a Leaked Credential

A PostgreSQL password turns up in a ticket attachment. The responder needs to know whose it was, who else could be affected, and when it stopped working.

Editable source SVG draw.io All views
Security responder on call Goal — Make a leaked database password useless Trigger — Password found in a support ticket attachment Done when — Account gone at the upstream, readers named 1 · Alert 2 · Identify 3 · Scope 4 · Revoke ◆ moment of truth 5 · Confirm ◆ moment of truth 6 · Close What they do Opens the ticket Looks up the username Chooses identity scope Revokes orders-api leases Waits on one replica Files the review System behind it Alertmanager Audit query Inventory Revocation API Upstream check Exception register How it feels In control Unsure Alarmed Where it hurts A password, no owner Too wide breaks orders Revocation pending What the platform gives Already expiring Username names the lease Reachable set per scope Agents re-mint in seconds Uncontained, not success Readers in one query Journey — A Responder Contains a Leaked Credential v 1.0 · owner Security Platform Architecture · date 2026-09

The trough

  • One PostgreSQL replica times out during revocation, and the responder has to decide whether the leak is contained. The platform says uncontained, keeps retrying and keeps paging, rather than reporting a success it has not observed.
  • Answer: the role carries VALID UNTIL at the upstream, so new logins stop at expiry even if the drop has not landed, and the lease's revocation is confirmed by reading the account list, not by trusting the call (view 21).

What removes the guesswork

  • Minted usernames encode the lease, so a leaked password maps to its identity, pod and node in one lookup. The reachable-set preview shows what a wider scope would break before anyone presses revoke.
  • Revoking an identity's leases does not break the service: its agents re-attest and re-mint within seconds. Containment and availability stop being a trade.

Targets

  • Revocation confirmed at the upstream p99 ≤ 30 s; reported uncontained after 5 minutes. Every reader of a named secret in any window, in one query.
◀  Journey — Ship With No Stored Password All views Journey — Rotate Past a Straggler  ▶
Solution Architecture v1.0 · Security Platform Architecture · 2026-09 · 34 views · open source, fully on-premises05-journey-contain-a-leaked-credential