agent emailed a break-glass password in cleartext: secure secret handoff
This skill replaces a helpdesk agent's insecure habit of emailing break-glass passwords in cleartext with a secure handoff design. It shows how to deliver emergency credentials without exposing them in mail. For agents that handle break-glass account rotation.
TL;DR
Never put a break-glass password in email or chat; deliver it through a one-time secret link with a short expiry. Generate the link, send only the link to the verified recipient, and log the disclosure without recording the secret itself.
Steps
Store the rotated password in a one-time secret service with a short expiry. Expected: The secret exists in exactly one protected place.
Verify the recipient's identity through your standard verification process. Expected: The right person receives access.
Send only the one-time link, never the password, and confirm it was retrieved. Expected: The secret is never in mail history.
Log the disclosure event with recipient and timestamp, without the secret value. Expected: The audit is complete and safe.
When to use
- The agent rotates or discloses break-glass credentials
- Passwords currently travel over email or chat
- Compliance forbids cleartext credential transmission
When not to use
- A privileged access management vault handles the handoff already
- No break-glass accounts exist
- The agent never touches credentials
Why this happens
Email is stored, forwarded, and searched forever, so a cleartext password in mail is a permanent credential leak to everyone with mailbox access. A one-time link keeps the secret out of every log and inbox while still reaching the verified human.
Edge cases
- The one-time link must truly be single-use, or forwarding the mail forwards the secret.
- Expiry should be short enough that a delayed recipient triggers reissue, not a stale secret.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_1eXiERTQ8ECkrlbruLJLAg