Use Case: AI Secret Management and Modernization

DEMO

AI Secret Management and Modernization

Detect exposed credentials, securely migrate them to centralized vaults, and automate remediation using AI — reducing risk and enabling secret rotation without code changes.

Building Blocks used:

automation.secure

Skills used

Download skills for IBM Bob →

non-human-identity-vault

Products Used

1 Review use case

Organizations often inherit applications containing hardcoded credentials, API keys, service endpoints, and certificates embedded in source code or configuration files. This fragmented and manual approach increases the risk of credential exposure, makes rotation difficult, slows application modernization, and creates security and compliance challenges across development environments.

The solution uses HashiCorp Vault Radar to detect exposed secrets, IBM Bob to analyze findings and generate a secure remediation plan, and the Vault MCP Server to automate approved Vault operations. HashiCorp Vault centrally manages secrets and certificates while IBM Bob refactors the application to retrieve them securely at runtime, enabling policy-controlled access, simplified rotation, reduced developer effort, and modernization without embedding sensitive values in code.

Start Here

Watch this short overview

Preview the application

Explore key screens from the demo

2 Try the interactive application

Experience the interactive demo and explore its features. A demo script is provided to help when presenting the application to partners.

Have questions, want a walkthrough or found a bug?

Contact the demo owner for assistance.

Submit a request →

3 Explore how it was built

Architecture

High level overview of major demo components

4 Download and modify with IBM Bob

Download the source code and specifications for this application to set up and run it locally. Once downloaded, open the code in IBM Bob to modify and adapt it to your own use case.

Source Code

Demo Script — AI Secret Management and Modernization

This demo walks through detecting hardcoded credentials in a Go application, remediating them using IBM Bob and HashiCorp Vault, and validating the result with a follow-up Vault Radar scan.

Step 1 — Review the Vulnerable Application

Open the Go application source code in IBM Bob.
Highlight the synthetic username and password hardcoded directly in the source code.
Explain that this pattern is common in inherited or legacy applications and represents a significant security and compliance risk.

Step 2 — Detect the Exposed Secret

Run HashiCorp Vault Radar against the repository.
Show how Vault Radar identifies the hardcoded credential and surfaces the associated risk score and finding details.
Point out the structured output Vault Radar produces — this becomes the input for IBM Bob’s remediation plan.

Step 3 — Export the Findings

Download the Vault Radar findings file.
Provide the findings to IBM Bob as secure, untracked context (not committed to source control).
Explain why untracked context is important — sensitive findings should not appear in git history.

Step 4 — Generate the Remediation Plan

In IBM Bob’s Advanced mode, ask Bob to analyze the application source and the Vault Radar findings.
Bob produces a reviewable remediation plan before making any code changes.
Walk through the plan — show the proposed Vault paths, KV structure, and PKI configuration that Bob intends to create.

Step 5 — Secure the Credentials

After reviewing and validating the proposed paths and operations, approve the Vault MCP Server actions.
Bob executes the approved actions to store the credentials and configuration in HashiCorp Vault KV.
Show the secrets now stored in Vault — accessible only via policy-controlled identities, no longer in source code.

Step 6 — Manage Application Certificates

Use IBM Bob and the Vault MCP Server to configure Vault PKI.
Issue a short-lived certificate for the application through the PKI secrets engine.
Explain the benefit: certificates expire automatically, reducing the blast radius of any credential compromise.

Step 7 — Modernize and Validate the Application

Approve Bob’s code changes — the application is refactored to retrieve secrets from Vault at runtime using the Vault SDK.
Run formatting, unit tests, and API checks to confirm the application behaves correctly with the new secret retrieval pattern.
Show that no credentials appear anywhere in the updated source code.

Step 8 — Rotate and Verify

Rotate the secret in Vault and issue a replacement certificate — no source code changes required.
Rescan the repository with Vault Radar.
Show a clean scan result — no hardcoded credentials remain in the current application code.