App Ops Desk · Issue #33
API keys and rotation before ship
Launch week is a bad time to discover the Maps key is still an unrestricted debug credential — or that prod push credentials expire mid-rollout.
One action this week: List every external key in this release binary and mark: owner, env (prod), expiry, blast radius if leaked.
Key inventory
Service | Key name | Env | Expiry | Scoped? | Where injected | Rotate owner
Gate
- No debug/test keys in Release
- Push/APNs credentials valid past your quiet-hours window
- Server allowlists include production bundle IDs
- Rotation plan if a key leaks on day one
Bottom line
Keys are ship blockers. Inventory them like entitlements — because they are.
Resources hub → Full library and jump-by-symptom links. Join the free list Product updates only. Founding checkout is separate and not live yet.