Comment by throwitaway222
14 hours ago
It may make sense to change security practices so nothing has long term access. Everything should be rotated monthly, and maybe within a few years, hourly.
14 hours ago
It may make sense to change security practices so nothing has long term access. Everything should be rotated monthly, and maybe within a few years, hourly.
Running a one-person SaaS, the honest failure mode isn't "we decided not to rotate", it's "rotation isn't automated so it just never happens". A stale token from 2023 still being alive in 2026 says less about policy and more about nobody having a reason to touch that code path in three years.
For a small team the fix that actually sticks is having the platform expire things by default (short-lived tokens, forced re-issue) rather than relying on a human remembering to rotate on a calendar. That calendar reminder is competing with every other thing on a solo dev's plate, and it reliably loses.