credential_parity 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: '004909c74b9ded92ab8c7f1498486a7c553b0a1810e63cc88bb71bc4c566e8a6'
+  data.tar.gz: 7cc15ea654e3373d38b4fdcd600a22cd92407f30fb8165ad02966c91956d4314
+SHA512:
+  metadata.gz: 0ca1a4c4f4ac1d42f8143b27b1cec892e7141792cfa9403c4a04dcb125f2ae20d2b5f796515d5fe9321ce423112db0c04727229a07a062ac60c5fcddd8420eb3
+  data.tar.gz: 1b31e46a91d96996032dd6125a76257e439ad849c2e05ab18eb20ec5fa16696a0125b05cebe71bf3e3237a270734231975a2806ae2d044e13cbfa8f1ae1d8648

data/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+## [0.1.0] - 2026-09-07
+
+Initial release.
+
+### Added
+- Compares the leaf key paths declared by each environment's encrypted credential file and fails when they disagree
+- Paths are compared, never values, so rotating one environment's secret is not drift and no secret can reach an error message
+- Nested drift is caught: a key misspelled in the middle of a path is found even though every environment still declares the same top level key
+- A declared key with no value or an empty mapping counts as a leaf rather than a branch
+- Asymmetric rule requiring no allowlist: a reference environment, mirrors that must declare exactly the same keys, and subsets that may omit keys but never add their own
+- Configurable `reference`, `mirrors`, `subsets`, `directory`, and `middleware_environments`
+- Development middleware over an `ActiveSupport::FileUpdateChecker`, so the files are only decrypted again after one of them changes
+- A failed check leaves the middleware wanting another, so correcting a file and reloading is enough with no restart
+- `credential_parity/rspec` for the test suite boot, next to `ActiveRecord::Migration.maintain_test_schema!`
+- `rake credential_parity:verify` for a deploy step or the command line
+- Self-disables where the keys are not all present, which is CI and every deployed host, so nothing fails there
+- `rails credentials:edit` is deliberately never gated, since it is the command used to repair drift
+- `SKIP_CREDENTIAL_PARITY_CHECK=1` escape hatch
+- Ruby 3.2, 3.3, and 3.4 support
+- Tested with Appraisal against ActiveSupport 7.0, 7.1, 7.2, and 8.0

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Velocity Labs, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,230 @@
+# CredentialParity
+
+Catch Rails credential drift between environments before it reaches production.
+
+[![CI](https://github.com/velocity-labs/credential_parity/actions/workflows/ci.yml/badge.svg)](https://github.com/velocity-labs/credential_parity/actions/workflows/ci.yml)
+[![Gem Version](https://badge.fury.io/rb/credential_parity.svg)](https://rubygems.org/gems/credential_parity)
+
+Rails ships nothing that compares your credential files to each other. Because
+the whole file is encrypted rather than just the values, a key added to three of
+four files and misspelled in the fourth is invisible in a diff, and
+`credentials.dig` returns `nil` for it rather than complaining. The first sign of
+trouble is the environment that missed it failing after a deploy, found by
+whoever ran the deploy rather than whoever made the change.
+
+```
+Credential keys are out of sync between environments.
+
+  staging is missing vendor.indexing_api.private_key, which production defines
+  staging defines vendor.indexing.private_key, which production does not
+```
+
+## Environment Roles
+
+Every environment is either a mirror of the reference or a subset of it. The
+defaults describe the shape almost every Rails app already has:
+
+| Environment | Role | May omit a key | May add its own key |
+|-------------|------|----------------|---------------------|
+| production | reference | n/a | n/a |
+| staging | mirror | No | No |
+| development | subset | Yes | No |
+| test | subset | Yes | No |
+
+The asymmetry is the point. A flat "all files must be identical" rule is wrong on
+its face, because development and test legitimately go without credentials for
+services only the deployed environments talk to. Letting them be subsets means
+no allowlist of exceptions to maintain, and no allowlist to go stale.
+
+## Requirements
+
+Ruby 3.2 or newer, and ActiveSupport 7.0 or newer.
+
+## Installation
+
+```ruby
+gem "credential_parity"
+```
+
+Then add the check to your test suite, next to the pending migration check that
+is already there:
+
+```ruby
+# spec/rails_helper.rb
+ActiveRecord::Migration.maintain_test_schema!
+require "credential_parity/rspec"
+```
+
+On Minitest, call it directly:
+
+```ruby
+# test/test_helper.rb
+CredentialParity.check!
+```
+
+That is all. The development middleware installs itself.
+
+## Usage
+
+### In development
+
+A middleware raises on page load when the files stop agreeing, the same way a
+pending migration does. It wraps an `ActiveSupport::FileUpdateChecker`, so the
+files are only decrypted again after one of them actually changes and the per
+request cost is a stat call. Correct the file and reload; no restart needed.
+
+### In your test suite
+
+`require "credential_parity/rspec"` at boot, next to `maintain_test_schema!`.
+This is the hook that catches the person who introduced the drift, because
+adding a credential is always followed by running something.
+
+### From the command line
+
+```bash
+bundle exec rake credential_parity:verify
+```
+
+Prints the environments it compared, or exits non-zero listing every violation.
+Useful in a deploy step, or when you want an answer without booting a server.
+
+### Anywhere else
+
+```ruby
+CredentialParity.check!       # raises DriftError, or returns nil
+CredentialParity.violations   # array of Violation, empty when clean
+CredentialParity.checkable?   # false when the keys are not all present
+```
+
+## Configuration
+
+All configuration is optional. CredentialParity works out of the box on an app
+with the usual four environments.
+
+```ruby
+# config/initializers/credential_parity.rb
+CredentialParity.configure do |config|
+  # The environment every other one is compared against (default: :production)
+  config.reference = :production
+
+  # Must declare exactly the same key paths as the reference (default: [:staging])
+  config.mirrors = [:staging, :demo]
+
+  # May omit keys, may never add their own (default: [:development, :test])
+  config.subsets = [:development, :test]
+
+  # Where the .yml.enc and .key files live
+  # (default: Rails.root.join("config/credentials"))
+  config.directory = Rails.root.join("config/credentials")
+
+  # Environments the page load middleware is installed in (default: [:development])
+  config.middleware_environments = [:development]
+end
+```
+
+An app with no staging environment sets `config.mirrors = []`.
+
+## How the comparison works
+
+Leaf key paths are compared, never values. Two consequences follow:
+
+- **Rotating a secret in one environment is not drift.** Every environment is
+  supposed to hold a different value for the same key.
+- **No secret can reach an error message.** Only path names are ever read out,
+  which matters because that message gets pasted into terminals and chat.
+
+Recursing to leaf paths, rather than comparing top level keys, is what catches
+the nested case. If production declares `vendor.indexing_api.private_key` and
+every other environment declares `vendor.indexing.private_key`, all four still
+declare a top level `vendor`, so a shallow comparison sees nothing wrong.
+
+A declared key with nothing under it, `some_key:` or `some_key: {}`, counts as a
+leaf. It is still a key one environment declares and another does not.
+
+## When it does not run
+
+The check needs every environment's key, so it runs on developer machines, which
+is the only place all of those keys exist, and quietly does nothing anywhere
+else. On CI and on deployed hosts only one environment's key is present, so there
+is nothing to compare and nothing fails.
+
+`rails credentials:edit` is deliberately never gated. It is the command used to
+repair drift, so a check that blocked it would lock you out of the fix. The
+scoping is copied from `ActiveRecord::Migration::CheckPending`, which Rails runs
+on web requests and at test boot but not for generators, `console`, or `runner`.
+
+Set `SKIP_CREDENTIAL_PARITY_CHECK=1` to bypass it entirely.
+
+## Error Handling
+
+All errors inherit from `CredentialParity::Error`, so you can catch everything
+with one rescue or handle specific cases:
+
+```ruby
+begin
+  CredentialParity.check!
+rescue CredentialParity::Error => e
+  # Catch any credential_parity error
+end
+```
+
+Specific error classes:
+
+| Error | When |
+|-------|------|
+| `CredentialParity::DriftError` | The environments disagree (message lists every path and where it is missing or extra) |
+| `CredentialParity::ConfigurationError` | No credentials directory could be resolved, or a violation carried an unknown kind |
+
+## Deployment Notes
+
+### CI
+
+Nothing to do. CI holds at most one environment's key, usually through
+`RAILS_MASTER_KEY`, so the check reports itself unable to run and your build is
+unaffected. Adding `rake credential_parity:verify` to CI is harmless but will
+skip for the same reason.
+
+### Deployed hosts
+
+Same story. A production dyno has `production.key` and nothing else, so parity
+cannot be evaluated there. If you want a deploy time gate, the thing to check on
+a deployed host is that every credential your code reads is present, which is a
+different question from whether the environments agree.
+
+## Contributing
+
+Bug reports and pull requests are welcome on [GitHub](https://github.com/velocity-labs/credential_parity).
+
+1. Fork the repo
+2. Create your feature branch (`git checkout -b my-feature`)
+3. Make your changes with tests
+4. Ensure all tests pass (`bundle exec rake test`)
+5. Commit and push
+6. Open a pull request
+
+## Testing
+
+```bash
+# Install dependencies
+bundle install
+
+# Run the full test suite
+bundle exec rake test
+
+# Run tests against a specific ActiveSupport version
+bundle exec appraisal activesupport-7.0 rake test
+bundle exec appraisal activesupport-8.0 rake test
+
+# Run all appraisals
+bundle exec appraisal rake test
+```
+
+Available appraisals: `activesupport-7.0`, `activesupport-7.1`,
+`activesupport-7.2`, `activesupport-8.0`.
+
+Tests generate their own encrypted fixtures in a tmpdir, so no real credential
+file is ever decrypted and no external services are needed.
+
+## License
+
+Copyright (c) 2026 Velocity Labs, LLC. Released under the [MIT License](LICENSE.txt).

data/lib/credential_parity/checker.rb

@@ -0,0 +1,89 @@
+require "active_support"
+require "active_support/encrypted_configuration"
+
+module CredentialParity
+  # Reads every declared environment's credential file and compares the sets of
+  # leaf key paths they declare.
+  #
+  # Paths, never values. Every environment is supposed to hold a different secret
+  # for the same key, so rotating one is not drift, and comparing paths alone
+  # means no secret can reach an error message.
+  class Checker
+    # EncryptedFile falls back to ENV[env_key] when the key file is absent. A real
+    # variable name here would let a CI-provided RAILS_MASTER_KEY decrypt one
+    # environment and then fail the rest on an invalid message, instead of
+    # reporting an honest "no key for that environment on this machine".
+    UNUSED_ENV_KEY = "CREDENTIAL_PARITY_UNUSED_ENV_KEY".freeze
+
+    def initialize(config)
+      @config = config
+    end
+
+    def checkable?
+      config.environments.all? { |environment| content_path(environment).exist? && key_path(environment).exist? }
+    end
+
+    def content_paths
+      config.environments.map { |environment| content_path(environment) }
+    end
+
+    def violations
+      return [] unless checkable?
+
+      paths = paths_by_environment
+      reference = paths.fetch(config.reference)
+
+      mirror_violations(paths, reference) + subset_violations(paths, reference)
+    end
+
+    private
+
+    attr_reader :config
+
+    def configuration_for(environment)
+      ActiveSupport::EncryptedConfiguration.new(
+        config_path: content_path(environment).to_s,
+        env_key: UNUSED_ENV_KEY,
+        key_path: key_path(environment).to_s,
+        raise_if_missing_key: true
+      )
+    end
+
+    def content_path(environment)
+      config.credentials_directory.join("#{environment}.yml.enc")
+    end
+
+    def key_path(environment)
+      config.credentials_directory.join("#{environment}.key")
+    end
+
+    # An empty mapping is a leaf, not a branch. "some_key:" with nothing under it
+    # is still a declared key, and walking into it would drop it silently.
+    def leaf_paths(value, prefix = [])
+      return [prefix.join(".")] if prefix.any? && !(value.is_a?(Hash) && value.any?)
+
+      value.flat_map { |key, nested| leaf_paths(nested, prefix + [key.to_s]) }
+    end
+
+    def mirror_violations(paths, reference)
+      config.mirrors.map(&:to_sym).flat_map do |environment|
+        own = paths.fetch(environment)
+        violations_for(environment, :missing, reference - own) + violations_for(environment, :unexpected, own - reference)
+      end
+    end
+
+    def paths_by_environment
+      config.environments.to_h { |environment| [environment, leaf_paths(configuration_for(environment).config).uniq.sort] }
+    end
+
+    def subset_violations(paths, reference)
+      config.subsets.map(&:to_sym).flat_map do |environment|
+        violations_for(environment, :unexpected, paths.fetch(environment) - reference)
+      end
+    end
+
+    def violations_for(environment, kind, paths)
+      paths.map { |path| Violation.new(environment: environment, kind: kind, path: path, reference: config.reference) }
+    end
+  end
+end

data/lib/credential_parity/configuration.rb

@@ -0,0 +1,38 @@
+module CredentialParity
+  # Which environments exist, and what each one is allowed to look like next to
+  # the reference. Every environment is either a mirror (must declare exactly the
+  # same keys) or a subset (may omit keys, may never add its own).
+  #
+  # The defaults describe the shape almost every Rails app has: production is the
+  # truth, staging is another deployed environment so it has to match, and the
+  # two local environments go without the credentials for services only the
+  # deployed environments talk to.
+  class Configuration
+    attr_accessor :directory, :middleware_environments, :mirrors, :reference, :subsets
+
+    def initialize
+      @directory = nil
+      @middleware_environments = [:development]
+      @mirrors = [:staging]
+      @reference = :production
+      @subsets = %i[development test]
+    end
+
+    def credentials_directory
+      return directory if directory
+      raise ConfigurationError, "Set CredentialParity.config.directory when Rails is not loaded" unless defined?(::Rails) && ::Rails.root
+
+      ::Rails.root.join("config/credentials")
+    end
+
+    def environments
+      ([reference] + mirrors + subsets).map(&:to_sym).uniq
+    end
+
+    def install_middleware?
+      return false unless defined?(::Rails) && ::Rails.respond_to?(:env)
+
+      middleware_environments.map(&:to_s).include?(::Rails.env.to_s)
+    end
+  end
+end

data/lib/credential_parity/middleware.rb

@@ -0,0 +1,46 @@
+require "active_support"
+require "active_support/file_update_checker"
+
+module CredentialParity
+  # The shape is lifted from ActiveRecord::Migration::CheckPending. The file
+  # watcher means the encrypted files are only decrypted again after one of them
+  # actually changes, so the per request cost is a stat call.
+  #
+  # The @needs_check flag is doing two jobs that are easy to miss. A freshly
+  # built FileUpdateChecker already considers itself current, so execute_if_updated
+  # on its own would never run the first check at all. And when a check raises,
+  # the flag stays set, so correcting the file and reloading is enough rather than
+  # having the failure recorded as a completed run.
+  class Middleware
+    def initialize(app, file_watcher: ActiveSupport::FileUpdateChecker)
+      @app = app
+      @file_watcher = file_watcher
+      @mutex = Mutex.new
+      @needs_check = true
+    end
+
+    def call(env)
+      @mutex.synchronize do
+        @watcher ||= build_watcher do
+          @needs_check = true
+          CredentialParity.check!
+          @needs_check = false
+        end
+
+        if @needs_check
+          @watcher.execute
+        else
+          @watcher.execute_if_updated
+        end
+      end
+
+      @app.call(env)
+    end
+
+    private
+
+    def build_watcher(&block)
+      @file_watcher.new(CredentialParity.content_paths.map(&:to_s), &block)
+    end
+  end
+end

data/lib/credential_parity/railtie.rb

@@ -0,0 +1,23 @@
+# Loaded unconditionally so that the Rails check lives in one place, in a file
+# that means nothing without Rails anyway.
+return unless defined?(::Rails::Railtie)
+
+module CredentialParity
+  class Railtie < ::Rails::Railtie
+    # After load_config_initializers so the host app's own configure block has
+    # already run, and still comfortably before the finisher builds the stack.
+    #
+    # A gem gets this for free where an app cannot. Code in an app's lib/ is
+    # autoloaded, and both config/environments/*.rb and config/initializers/*.rb
+    # run before :setup_main_autoloader, so referencing middleware from either
+    # raises NameError. Gem code is required at Bundler.require time, so the
+    # constant is simply there.
+    initializer "credential_parity.middleware", after: :load_config_initializers do |app|
+      app.middleware.use CredentialParity::Middleware if CredentialParity.config.install_middleware?
+    end
+
+    rake_tasks do
+      load File.expand_path("../tasks/credential_parity.rake", __dir__)
+    end
+  end
+end

data/lib/credential_parity/rspec.rb

@@ -0,0 +1,9 @@
+require "credential_parity"
+
+# Checks parity as the suite boots, next to where rails_helper.rb already calls
+# ActiveRecord::Migration.maintain_test_schema!. This is the hook that catches
+# the person who introduced the drift, because adding a credential is always
+# followed by running something.
+#
+# No-ops unless every environment's key file is present, so CI stays green.
+CredentialParity.check!

data/lib/credential_parity/version.rb

@@ -0,0 +1,3 @@
+module CredentialParity
+  VERSION = "0.1.0".freeze
+end

data/lib/credential_parity/violation.rb

@@ -0,0 +1,11 @@
+module CredentialParity
+  Violation = Struct.new(:environment, :kind, :path, :reference, keyword_init: true) do
+    def message
+      case kind
+      when :missing then "#{environment} is missing #{path}, which #{reference} defines"
+      when :unexpected then "#{environment} defines #{path}, which #{reference} does not"
+      else raise ConfigurationError, "Unknown violation kind #{kind.inspect}"
+      end
+    end
+  end
+end

data/lib/credential_parity.rb

@@ -0,0 +1,95 @@
+require "credential_parity/version"
+require "credential_parity/configuration"
+require "credential_parity/violation"
+require "credential_parity/checker"
+require "credential_parity/middleware"
+require "credential_parity/railtie"
+
+# Rails ships nothing that compares the environment credential files to each
+# other. Because the whole file is encrypted rather than just the values, a key
+# added to three of four files and misspelled in the fourth is invisible in a
+# diff, and credentials.dig returns nil for it at runtime rather than
+# complaining, so the first sign of trouble is the environment that missed it
+# failing after a deploy.
+module CredentialParity
+  SKIP_ENV_VARIABLE = "SKIP_CREDENTIAL_PARITY_CHECK".freeze
+
+  class Error < StandardError; end
+
+  # The environments disagree about which keys exist.
+  class DriftError < Error; end
+
+  # The library cannot work out where to look, or was handed something it does
+  # not understand.
+  class ConfigurationError < Error; end
+
+  class << self
+    # Raises when the declared environments disagree. Does nothing when the key
+    # files are not all present, which is the normal case on CI and on every
+    # deployed host, where only one environment's key exists.
+    def check!
+      found = violations
+      return if found.empty?
+
+      raise DriftError, error_message(found)
+    end
+
+    def checkable?
+      return false if skip?
+
+      checker.checkable?
+    end
+
+
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+    end
+
+    def content_paths
+      checker.content_paths
+    end
+
+    def reset!
+      @checker = nil
+      @config = nil
+    end
+
+    def violations
+      return [] if skip?
+
+      checker.violations
+    end
+
+    private
+
+    def checker
+      Checker.new(config)
+    end
+
+    def error_message(found)
+      <<~MESSAGE
+        Credential keys are out of sync between environments.
+
+        #{found.map { |violation| "  #{violation.message}" }.join("\n")}
+
+        #{config.reference} is the reference. #{list(config.mirrors)} must declare exactly the same keys.
+        #{list(config.subsets)} may omit keys but must not add keys of their own.
+
+        Correct whichever file is wrong with `bin/rails credentials:edit --environment ENVIRONMENT`,
+        or set #{SKIP_ENV_VARIABLE}=1 to bypass this check.
+      MESSAGE
+    end
+
+    def list(environments)
+      environments.map(&:to_s).join(", ")
+    end
+
+    def skip?
+      !ENV[SKIP_ENV_VARIABLE].to_s.empty?
+    end
+  end
+end

data/lib/tasks/credential_parity.rake

@@ -0,0 +1,21 @@
+namespace :credential_parity do
+  desc "Verify that the environment credential files declare the same keys"
+  task verify: :environment do
+    unless CredentialParity.checkable?
+      puts "Skipped: every declared environment's key file must be present to compare them."
+      next
+    end
+
+    violations = CredentialParity.violations
+
+    if violations.empty?
+      puts "Credential keys are in sync across #{CredentialParity.config.environments.join(', ')}."
+      next
+    end
+
+    # abort rather than raise. An exception reporter hooked into rake would treat
+    # a raise here as a production error, and drift is a local condition for the
+    # developer to fix rather than something worth paging on.
+    abort violations.map(&:message).join("\n")
+  end
+end

metadata

@@ -0,0 +1,74 @@
+--- !ruby/object:Gem::Specification
+name: credential_parity
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Velocity Labs, LLC
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+description: 'Compares the leaf key paths declared by each of your Rails encrypted
+  credential files and fails when they disagree. Paths only, never values, so rotating
+  a secret is not drift and no secret reaches an error message. Hooked where Rails
+  already checks for pending migrations: a development middleware, the test suite
+  boot, and a rake task.'
+email:
+- admin@velocitylabs.io
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/credential_parity.rb
+- lib/credential_parity/checker.rb
+- lib/credential_parity/configuration.rb
+- lib/credential_parity/middleware.rb
+- lib/credential_parity/railtie.rb
+- lib/credential_parity/rspec.rb
+- lib/credential_parity/version.rb
+- lib/credential_parity/violation.rb
+- lib/tasks/credential_parity.rake
+homepage: https://github.com/velocity-labs/credential_parity
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/velocity-labs/credential_parity
+  source_code_uri: https://github.com/velocity-labs/credential_parity
+  changelog_uri: https://github.com/velocity-labs/credential_parity/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Catch Rails credential drift between environments before it reaches production
+test_files: []