The Secret Zombie Attack
Access survives an incomplete cleanup.
A Secret Zombie Attack begins when secrets refuse to stay dead after rotation theater. You issue a replacement key. You announce the rotation. You update the wiki. You feel briefly like an adult. The old key was never revoked, a refresh token still issues sessions, or the agent found a second credential in a forgotten configuration file. Access continues. The change ticket closes. Everyone has completed the part visible to their dashboard.
Symptom
Rotated credentials keep working. Live sessions outlive their keys. Agents find second credentials in forgotten configs. The ticket closes while the access remains.
Why It Matters
A correctly revoked key stays revoked, however many copies survive. The Secret Zombie is access surviving an incomplete cleanup: other credentials, live sessions, excessive grants, and automation able to obtain fresh authority.
What the Chapter Gives You
The cleanup checklist that actually kills access, why rotation is not revocation, and the verification step that proves the zombie stayed dead.
Want the full chapter? Grab the free cheat sheet, read an excerpt, or get the book.
Recognize this one in your codebase?
Free cheat sheet, excerpts, and interactive diagnostics.