| CCC.SecMgmt.TH01 | Secret Values are Exposed Outside the Service | A secret value retrieved through the API or command-line interface may be written to terminal output, shell history, build logs, environment variables, or application logs, or may be readable by any identity holding a broad read permission on the secret. Plaintext copies of the value then exist outside the service's access control and audit trail. The confidentiality of the credential is lost, and the credential could be used to access the systems it protects. | 0 | 1 | 1 |
| CCC.SecMgmt.TH02 | Secret Values are Replaced by Unauthorized Entities | Write permission on a secret may be granted more broadly than read permission, or may be obtained through a compromised identity, allowing a new version to be stored with a value chosen by the writer. External systems that consume the secret then authenticate with the substituted credential or connect to an endpoint named in it, redirecting data to an unintended destination or failing to authenticate. The integrity of the credential and the availability of the systems that depend on it are affected. | 0 | 1 | 1 |
| CCC.SecMgmt.TH03 | Secrets are Not Rotated or Rotation Fails | A rotation schedule may be absent, the rotation function may fail before it stores the new value as a new secret version, or a rotation-due notification may go unanswered where the provider only notifies an external system. A credential then remains valid for an unbounded period, so a compromise that is never detected keeps granting access, while a partially completed rotation can leave external systems holding a credential that the target no longer accepts. Confidentiality of the protected systems and availability of their consumers are affected. | 0 | 1 | 1 |
| CCC.SecMgmt.TH04 | Secret Versions are Disabled While Systems Still Depend on Them | A secret version may be disabled, so that it still exists but its value can no longer be read, or scheduled for destruction while external systems still depend on it, and a destroyed version cannot be recovered once its recovery window elapses. Retrieval requests then fail or return no current version, and the credential material is lost if no other copy exists. The availability of every system that depends on the secret is affected. | 0 | 1 | 1 |