Database credentials are rotated on a defined schedule

A database password that has never been rotated since project creation has been exposed to every team member who ever had environment access, every CI system that logged the connection string, and any third-party service that consumed it. CWE-255 captures long-lived credentials as a vulnerability class: the longer a credential is in use without rotation, the larger the set of people and systems that have seen it. A defined rotation schedule limits the exposure window for any past compromise that has not yet been detected.

Document a 90-day rotation schedule in SECURITY.md and set a calendar reminder. For production systems, prefer AWS Secrets Manager or Doppler with automatic rotation.

# SECURITY.md — Credential Rotation Policy

## Database Credentials
- Rotation schedule: every 90 days
- Rotation procedure:
  1. Generate new password: openssl rand -base64 32
  2. Update DB user: ALTER USER app_user WITH PASSWORD 'new_password';
  3. Update secret in Vercel/AWS/Doppler env configuration
  4. Redeploy application
  5. Verify application health, then document rotation date below

Last rotated: [date]

For AWS RDS, configure Secrets Manager rotation: aws secretsmanager rotate-secret --secret-id myapp/db-credentials --rotation-rules '{"AutomaticallyAfterDays": 90}'. For Supabase, reset the database password in Dashboard > Settings > Database and update all deployment environments.