key-cape/workplans/KEY-WP-0011-live-secret-exposure-recovery.md

---
id: KEY-WP-0011
type: workplan
title: "Recover from live KeyCape Secret output exposure"
domain: infotech
repo: key-cape
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-08-23"
updated: "2026-08-23"
state_hub_workstream_id: "158aa957-8818-52ea-b7a5-3962cf30ba5e"
---

# KEY-WP-0011 — Live KeyCape Secret exposure recovery

Recover safely after the base64 data map of Kubernetes Secret
`sso/keycape-config` was mistakenly rendered in agent tool output during a
metadata check. Never reproduce, decode, or store the exposed payload.

## Contain and notify owners

```task
id: KEY-WP-0011-T01
status: done
priority: high
state_hub_task_id: "a8f5e33d-c725-5181-849e-a42bba34d3d8"
```

Stopped live rollout work, treated the payload as exposed, and notified
railiance-platform and NetKingdom without values. The affected classes are the
KeyCape RS256 signing private key and credentials embedded in `config.yaml`
(LLDAP bind credential, Authelia client credential, and privacyIDEA admin
token). No value was decoded, reused, or intentionally repeated and no live
mutation was attempted.

## Approve and execute coordinated rotation

```task
id: KEY-WP-0011-T02
status: done
priority: high
state_hub_task_id: "9d60569c-a0f1-53a9-b4dc-01687ab92bcc"
```

Approved by the operator on 2026-08-23, accepting deliberate invalidation of
active sessions and a brief SSO interruption. The RS256 key, LLDAP bind/admin
credential, Authelia-KeyCape client credential, and privacyIDEA application
signing secret were replaced without rendering values. The exposed
privacyIDEA admin JWT was removed from live use. Replacement material is
recoverable only through the NetKingdom age recipient in the encrypted
recovery overlay under `history/`.

## Verify recovery without values

```task
id: KEY-WP-0011-T03
status: done
priority: high
state_hub_task_id: "a079573d-97fd-5c6c-b1f9-c0af65e2933a"
```

Verified changed resource versions and public JWKS fingerprints, four Ready
deployments, successful replacement LLDAP and Authelia authentication,
wrong-secret rejection, explicit privacyIDEA fail-closed denial, issuer
discovery, and the OpenBao callback handoff to Authelia. The temporary LLDAP
force-reset flag was removed. No Kubernetes Secret payload or authentication
value was rendered during recovery.