RedHub AIRedHub AI
Tool Gate · How it works

How the roll-up gate works

How the Keys & Secrets Sorting Drill gate works

This tool grades each key on where it lives now and whether it has ever been somewhere it shouldn't. It reads 10 keys and rolls them into one verdict — the worst, never the average — then a gate that can only make it worse.

The 10 keys

01K-01 · Database service keysecret · server env · never publicSAFE WHERE IT IS
02K-02 · Email sending API keywas public once, never rotated sinceROTATE NOW
03K-03 · Payment processor secret keywas public once — but rotated sinceSAFE WHERE IT IS
04K-04 · Database public API keypublishable by designMEANT TO BE PUBLIC
05K-05 · Analytics write tokensecret, shipped in the client bundleROTATE NOW
06K-06 · Deployment token in .env.exampleprivate repo · not reachable, but wrong homeMOVE IT
07K-07 · Payment processor publishable keypublishable by designMEANT TO BE PUBLIC
08K-08 · Old admin token from the first buildfix firstlocation not foundROTATE NOW
09K-09 · Map tile keyclass not found → still lands safeSAFE WHERE IT IS
10K-10 · AI provider key pasted for helpsecret, pasted into a shared chatROTATE NOW
KEYS HELD
nothing secret is reachable, and nothing needs rotating
KEYS MISPLACED
a secret is in the wrong home but not reachable
KEYS BURNED
a secret is reachable, or was once and was never rotated
Irreversibility · worsen-only

Reachable once and not rotated since is ROTATE NOW, no matter where the key lives today. Tidying cannot undo exposure — moving a burned key to a safe home leaves it burned. An unfound answer is scored as the worst answer that blank could have hidden, so looking less hard never improves the result.

KEYS BURNED

Why: Four of ten keys need rotating, and only two of those are reachable right now. The other two are the point of the drill: one was public once and was never rotated, and one has a home nobody could find. K-03 was public once too — but it was rotated, so it lands safe. Two publishable keys are public by design and never count against you. 4 of 10 need rotating · 2 reachable now · worst-not-average.

Fix firstK-08, the old admin token from the first build — where it lives could not be found, so it resolves to the worst place it could be

No single key is the crisis — the clustering is. The roll-up takes the worst, the gate escalates when trouble compounds, and it names the one thing to fix first. Grades where credentials live, never a person. It never asks for a key value and connects to nothing — it reads back what you tell it, using rules you can see.