Secrets, expiry and drift
xNode360 doesn’t hold your credentials: it keeps a pointer, an expiry date and the list of places the secret lives.
What is stored
For each secret: name, vault type, reference and path, owner, notes, expiry date and the “locations” where it’s copied. There is no field for the value: not in the app, not in the manifest, not in MCP.
The value is only read at check time, for http-auth and pg, by the process running the check (the worker or your agent), held in memory and never written to the database. With an agent, the read happens on your server, from your vault.
With the cloud runner, xNode360’s own worker reads the value for the duration of the check. If you don’t want a credential to go through there, use an agent.
Vault types
The list includes manual, environment variable, Infisical and a series of integrations (Doppler, GitHub Secrets, Vercel, Netlify, Cloudflare Workers, 1Password, Bitwarden, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault). Right now these are labels: they say where the secret lives, but xNode360 doesn’t connect to those services. Integrations show “not connected — declare it by hand for now”.
Expiry
| State | When | Color |
|---|---|---|
| valid | More than 14 days left. | cyan |
| expiring | 0 to 14 days left. | amber |
| expired | The date has passed. | red |
| no expiry | No date set (∞). | gray |
Days are rounded up and the chosen date counts at midnight UTC. On the expiry day itself the secret is still “expiring”.
Locations and drift
A location is a place where a copy of the secret lives: GitHub Actions, a VPS env, Firebase config, Cloudflare or other. Each location can be:
- synced — it has a sync date and is no older than the last rotation;
- out of date — it has never been synced, or the secret was rotated after.
A secret with at least one out-of-date location is in drift: the source changed but some copy fell behind. A secret with no locations can’t drift.
- The
↻ rotatedbutton marks the secret as rotated now: every already-synced location becomes “out of date”. It doesn’t change the expiry. - Click a location’s name to mark it as synced.
The alert at the top
The ⚠ N secrets badge counts, across the whole map, expired + expiring + drifting secrets (edges included). A secret that is both expiring and drifting counts twice. It’s red if at least one secret is expired, otherwise amber; the tooltip shows the breakdown. The badge isn’t clickable.
Alerts are visual, inside the app. For now xNode360 sends no email or external notifications.