How Oleria picks a recommendation
Every risk reason has a general recommendation that applies to any application. For some applications and secret types, Oleria shows a more specific recommendation based on the vendor’s own security guidance. For example, an AWS access key with no expiration gets Replace the access key with an IAM role. instead of the general recommendation. Oleria uses the most specific recommendation that matches the secret:- A recommendation for the secret’s application and secret type.
- The general recommendation for the risk reason.
Expired, disabled, and revoked secrets aren’t shown on the Secrets page, so Oleria doesn’t report risks for them.
Authenticates a high-privilege identity
The secret carries the full access of an identity that Oleria rates as high privilege: a machine or token account whose Privilege Level is High, or any other account that’s an admin. A secret limited to specific scopes is checked under Granted high-privilege scopes instead. Why it matters: Anyone who obtains this secret gains the identity’s high-privilege access. Recommendation: Cut the identity’s permissions to what it uses.Granted high-privilege scopes
The secret is limited to specific scopes, and those scopes include high-privilege permissions. Why it matters: A leaked secret grants every permission in its scopes, including high-privilege ones the integration may never use. Recommendation: Reissue the secret with only the scopes it uses. All applications use this recommendation.Expiring soon
The secret expires within your workspace’s near-expiry window, which is 30 days by default. The Near Expiry tile on the Secrets page shows the window your workspace uses. Why it matters: Integrations still using the secret stop authenticating when it expires. Recommendation: Rotate the secret before it expires.No expiration set
The application reports that the secret never expires. Stored secrets, such as a secret in a vault, aren’t flagged for this reason: the expiry on a vault entry covers only the stored copy, so Oleria flags the credential where it’s issued instead. Why it matters: A secret that never expires stays valid after a leak until someone revokes it. Recommendation: Set an expiry and rotate the secret regularly.Shared across identities
The secret authenticates more than one identity. Why it matters: One leaked secret compromises every identity it authenticates, and rotating it disrupts all of them at once. Recommendation: Give each identity its own secret. All applications use this recommendation.Not vaulted
The secret is kept by whoever uses it, outside any secrets manager. Why it matters: Copies held outside a vault are hard to track and rotate, and can leak through code, config, or logs. Recommendation: Move the secret into a secrets manager. All applications use this recommendation.Oleria raises this risk reason only when an application reports that a secret is kept outside a vault. No connected application reports this yet, so you won’t see it today.