Zeema
New design
Catalogue / rules

Credentials without rotation

warningcredentials-without-rotation

The design stores data but says nothing about rotating the credentials that reach it, and it has no key-management node that would rotate them. A leaked credential stays valid forever.

Severity
warning
Selects
every design
Components in scope
2,366
What it checks

It looks at every design, and fires when:

  • — all of these hold:
  • — the design contains a node in category data
  • — the design requirement `security.credentialRotationDays` has no value
  • — this does not hold:
  • — the design contains a node of kind key-management
Message
Design '{{design.id}}' holds data but declares no credential rotation period and has no key-management node.

{{node.id}} style paths are filled in from the node, the edge or the design the finding is about.

Applies to · 2,366 components

This rule is about the whole design, not one node.

This rule names no kind: it reads the design as a whole.
Tripped by · 12

Reference designs whose broken twin names this rule in its header. The gate reads the same header, and fails when a rule no design trips.

ad-click-aggregationreferenceairbnb-searchreferencebooking-searchreferencecoinbase-exchangereferencedistributed-message-queuereferencelinkedin-kafkareferencenotion-shardingreferencepayment-systemreferencepaypal-paymentsreferencespotify-playbackreferencewhatsapp-messagingreferencezoom-videoreference
Source
# yaml-language-server: $schema=../schema/rule.schema.json
# The design stores data but says nothing about rotating the credentials that reach it,
# and there is no key-management node that would rotate them. Leaked credentials then
# stay valid forever.
# Tripped by: designs/payment-system.broken.yaml
schemaVersion: "1"
type: "rule"
id: "credentials-without-rotation"
severity: "warning"
select:
  design: true
when:
  all:
    - hasNode:
        category: "data"
    - requirement: "security.credentialRotationDays"
      exists: false
    - not:
        hasNode:
          kind: "key-management"
message: "Design '{{design.id}}' holds data but declares no credential rotation period and has no key-management node."

The same page as markdown, for an agent: /catalogue/rules/credentials-without-rotation.md