Secret rotation

Last updated: Nov 3, 2026

---

Key rotation is essential when an organization works with sensitive data. The best way to prevent key leaks is to change keys regularly. These are the rotation cycles of Fluid Attacks:

• KMS keys: Every 90 days, or before if necessary
• JWT tokens: Each day
• Digital certificates: Short-lived, renewed automatically (14 days for fluidattacks.com)
• IAM passphrases: Every three months

Fluid Attacks does rotations in these two ways:

• Automatic rotation: Fluid Attacks stores some secrets in secret vaults. Only administrators can get access to them, and the system rotates them each day. These secrets include JWT tokens and IAM passphrases.
• Manual rotation: Fluid Attacks stores some secrets in Git repositories, versioned and encrypted with AES-256 symmetric keys. Fluid Attacks manages them as code. Thus, their rotation requires manual approval. These secrets include application credentials.

The digital certificates are not in the secret vaults or in Git. Cloudflare issues and renews the edge certificates of the Fluid Attacks domains automatically. The certificate of fluidattacks.com is valid for 14 days.

Requirements

• 089. Limit validity of certificates
• 130. Limit password lifespan
• 145. Protect system cryptographic keys

Other secure authorization measures

• Access revocation
• Authorization for clients
• Authorization for Fluid Attacks staff
• Employee termination
• Endpoint management
• Session management