4.4 Encrypted Vault Secrets & Zero-Leakage Safe Code Export

How to manage passwords and API tokens in the project Vault and export pure Playwright code with zero secret leakage.

Secrets Don’t Belong in a Test Script

A password or API token typed straight into a step’s value field ends up wherever that step’s history does – version control if the case is ever exported, screen-share if someone demos the test, a support ticket if a run gets attached to a bug report. The Vault exists so a secret only ever exists in one encrypted place. Under the hood, each secret is wrapped in envelope encryption: a per-secret data key encrypts the value with AES-GCM-256, and that data key is itself encrypted by your organization’s own KMS or HashiCorp Vault master key – so a key rotation re-wraps the data keys against a new master key version without touching the underlying secret values or interrupting any run in progress.

Once stored, a secret is referenced the same way from any step – {{ vault.STRIPE_SECRET_KEY }} or the equivalent ${SECRET:STRIPE_SECRET_KEY} expression macro (see 4.3) – and resolved at run time, never displayed back in the UI or written into a case’s saved definition.

Scoping a Secret to an Environment

A secret can be Global (the default, used everywhere) or bound to one specific environment, like staging or production. When both exist for the same key, the environment-specific value wins for a run executing against that environment – so the same {{ vault.STRIPE_SECRET_KEY }} reference in a step resolves to your sandbox key on staging and your live key on production, without editing a single step to switch between them.

Adding and Rotating a Secret

• 1. Open Settings -> Secrets & Vault and click “Add Secret”.
• 2. Enter a Key (e.g. ERP_ADMIN_PASSWORD) and the secret Value; leave Target Environment on Global to apply everywhere, or pick a specific environment to scope and override it there.
• 3. Reference it in any step as {{ vault.ERP_ADMIN_PASSWORD }} or ${SECRET:ERP_ADMIN_PASSWORD} – both resolve the same value.
• 4. To rotate later, edit the same secret and enter a new Value – leaving that field blank on an edit keeps the current secret unchanged, so renaming just the description can’t accidentally wipe out a working value.

What Happens on Export

• Exporting a case to Playwright TypeScript turns a vault reference into process.env.KEY_NAME rather than the literal secret – the generated file expects that environment variable to actually be set wherever it runs. Forgetting to configure it in your own runner or CI job is the most common reason an exported test behaves differently from the same case run inside CertiQA.