API security & identity
Secrets leave the codebase, the tickets and the consoles: they are read at runtime from Vault. And every pipeline action is traceable to a named person — not a shared service account.
What we do
- Gateway and CI credentials read at runtime from HashiCorp Vault — nothing sensitive left in Git
- End-to-end OAuth2/OIDC chains (Keycloak, RFC 8693 token exchange) down to systems that don’t speak them natively
- Overlap-based credential rotation: two valid secrets during the transition, zero interruption
- Per-user identity propagated through pipelines: who deployed what, when, with which approval
How we deliver
Every control is verified fail-closed: we prove not only that the nominal path works, but that the forbidden paths fail — spoofing, expired secret, out-of-scope call.
Does this sound like your context? Describe it in a few lines.
Discuss your project