Custom Rotation Scripts

Extend rotation to any target not covered by built-in engines. Each secret can have three associated shell scripts: rotate (generates new credential and applies it to the target system), verify (confirms the new credential is accepted), and rollback (reverts to the previous value if verify fails).

Scripts execute in a sandboxed environment with a 60-second timeout, restricted PATH, and no network access beyond explicitly allowed endpoints. Environment variables expose the current and previous secret values securely.

Key Configuration

• Script paths (rotate / verify / rollback)
• Execution timeout
• Allowed outbound endpoints
• Environment variable allowlist