The Credential That Everyone Can See
A bot developer built a vendor-portal bot that logs in using a service account. To save time, the username and password were typed directly into the bot's variables during development and the bot was promoted to production unchanged. The bot now runs unattended every 30 minutes, 24/7. During a CoE review, an auditor discovers that the credential is visible to anyone who can open the bot in the development environment, and that three contractors have edit access to that folder. The password has not been rotated in 14 months. The business owner argues the bot 'works fine' and rotation would cause downtime.
1. Assess the risk and identify the governance failures this situation reveals.
Read the worked answer
Risk: A long-lived, widely visible service-account credential guarding a vendor portal is a high-severity exposure. Anyone with edit or view access to the bot - including three contractors - can read the password. Fourteen months without rotation widens the blast radius: if leaked, the credential is valid and the account likely has standing privileges. Because the bot runs every 30 minutes, any misuse blends into normal traffic and is hard to detect.
Governance failures:
- No secrets management: Credentials belong in a managed credential store/vault, referenced by the bot at runtime - never hard-coded in variables or the artifact.
- Excessive access: Contractors with edit rights to a production bot violate least privilege; promotion should separate build from deploy.
- No credential lifecycle: No rotation policy, no ownership, no expiry.
- Weak promotion gate: A bot reached production without a security review - the CoE gate failed.
- No monitoring for anomalous use of the service account.
This is a process failure as much as a technical one: the 'it works fine' argument conflates functional success with security posture.
2. The business owner resists rotation due to downtime fears. Propose a remediation path that addresses the risk without an extended outage.
Read the worked answer
Sequence remediation so security improves immediately while downtime stays near zero:
- Contain now (hours): Remove contractor edit access to the bot/folder; restrict to least privilege. Move the credential into the managed credential store and change the bot to reference it - this removes the plaintext exposure without changing the password yet.
- Rotate safely (planned window): Rotate the service-account password in the vendor portal and update the vault entry. Because the bot pulls from the vault at runtime, the change is a single update, not a code change. Schedule it in a low-traffic window; with vault-based lookup the effective downtime is the time to update one secret, not a redeploy.
- Prove it: Run a supervised execution immediately after rotation to confirm the bot authenticates, then monitor the next few cycles.
- Institutionalize: Set a rotation cadence (e.g., 90 days), assign an owner, add a promotion gate that blocks hard-coded secrets, and log service-account usage with alerting on anomalies.
Reframe for the owner: The current setup is one leak away from a vendor-portal compromise; vault-based lookup makes future rotations cheap and near-downtime-free, which is the opposite of the status quo. The first rotation is the hardest; the process pays off every cycle after.