# Secrets rotation (P7.SEC.01)

## Staging
Rotate APP_KEY only with planned downtime; rotate DB/Redis/PSP sandbox keys quarterly.

## Production
- Secrets live in vault only (never repo / CI logs).
- `.env.example` placeholders only.
- After suspected leak: rotate + invalidate sessions.