Secret Rotation & Versioning

RunEnv records version and audit history for supported secret changes. Availability depends on the configured retention period and the caller's access.

Secret Versioning

When a supported dashboard or API update creates a new secret version, the previous row is preserved as history rather than deleted and recreated. How long that history remains available depends on the applicable retention policy.

To view the history of a secret in the dashboard:

1. Navigate to your project and environment.
2. Click the History or Clock icon next to the secret value.
3. You will see a list of all versions, including who made the change and when.

Rollbacks

If a bad value is deployed (for example, a typo in a database URL), an authorized user can restore an available previous version from the Secret History panel.

Secret Rotation

Rotating secrets (changing passwords, generating new API keys) is a best practice to limit the impact of potential leaks.

When rotating a static secret, follow these steps to minimize downtime:

1. Generate the new secret (e.g., in your Database provider or Stripe dashboard).
2. Update the secret value in RunEnv. This creates a new version.
3. Restart your application servers so they fetch the new value via runenv run.