Rotating Secrets Without a Maintenance Window

For a long time I treated session management as something to worry about later. Then a small change to our Semgrep setup turned into a week of debugging, and "later" arrived all at once.

The setup was ordinary: Semgrep at the edges, Trivy doing most of the heavy lifting, and a handful of scripts nobody wanted to own. It worked well until usage roughly doubled over a single quarter.

The problem

When we finally measured, the numbers were worse than anyone guessed. Around 24% of the time spent on a typical change went into working around session management rather than building anything.

The first symptom was subtle. Nothing failed outright, but session management kept drifting in the wrong direction, and every fix seemed to make the next one harder.

The fix

The fix turned out to be smaller than expected. Instead of adding another layer, we removed one and leaned on what Semgrep already gives you out of the box.

The core of it looks like this:

Content-Security-Policy: default-src 'self';
  script-src 'self' 'nonce-r4nd0m';
  style-src 'self';
  img-src 'self' data:;
  frame-ancestors 'none';
  base-uri 'self'

Nothing about this is clever, and that's the point. Anyone on the team can read it in a minute and know exactly what it does.

A few things that helped along the way:

Write the migration guide before writing the migration.
Measure before and after, even if it's just a rough number in a spreadsheet.
Pair on the first few changes so the knowledge doesn't live in one head.

Trade-offs

There are cases where this falls apart. If your team is very small or your traffic is very spiky, the extra moving parts may not pay for themselves.

The biggest cost was social, not technical. Changing how people think about session management takes much longer than changing the code.

Wrapping up

I don't think there's a universal answer here, but I hope this gives you a few ideas to try on your own project. If you do, I'd love to hear how it goes.