The Secret Lifecycle Your Jira Workflow Is Missing

“Resolved” is not a credential state

The Jira issue says Done. The comment containing the token was deleted. A developer says the service “looks fine.” Nobody recorded whether the old token was revoked, which jobs consumed it, or whether it was used from an unfamiliar address.

A generic incident workflow tracks human activity. A credential workflow must track changes in authority.

OWASP’s Secrets Management Cheat Sheet defines creation, rotation, revocation, and expiration as distinct lifecycle stages. It also recommends metadata covering who created, consumed, rotated, or deleted a secret; what uses it; and when it must rotate. Those facts map naturally to a Jira workflow, but not to a single checkbox called “credential changed.”

Use states that can be disproved

Design each transition around evidence:

Detected → Contained. The exposed representation is redacted, redistribution paths are identified, and the credential owner is assigned. Contained does not mean revoked.

Contained → Replacement deployed. Every known consumer has received the replacement and health checks pass. For a token with no dependants, this can be immediate.

Replacement deployed → Old authority revoked. The provider confirms the old version was disabled or deleted. A comment saying “rotated” is not equivalent to provider evidence.

Revoked → Verified. A controlled check shows the old credential fails, the replacement works, and relevant access logs were reviewed for the exposure window.

Verified → Closed. The team records why exposure occurred and assigns a preventive control.

Separate evidence from sensitive material

Never attach the plaintext credential to prove which credential was involved. Use a safe token identifier, provider-side key ID, or one-way fingerprint. Restrict the incident if logs contain sensitive customer data, but keep non-sensitive remediation evidence available to auditors and future responders.

Automation should create and enrich the record, not auto-close it. Secret Sentinel can turn high-risk Jira or Confluence findings into Jira incidents and provides risk classification. Your workflow should then require the human and provider-side evidence the scanner cannot manufacture.

Connect the development path

When teams distribute .env files manually, the workflow often cannot enumerate recipients. envseal gives each team member a recipient key and keeps encrypted values in git, making intentional distribution more explicit. Revoking a person’s vault access and rotating an exposed service credential remain separate actions; the Jira model should record both when both are necessary.

The conversion from “security ticket” to “credential state machine” is small, but it changes the closing question from “did someone work on this?” to “can the exposed authority still be used?”