CLI command
skarbiec exposure
After a leak, a lost laptop or a departing contractor, answer for one item everything that could have learned its value, so the decision to rotate it and the steps to shut each reader out come from one answer.
Invocation#
skarbiec exposure <id> [--since <iso8601>]Purpose#
After a leak, a lost laptop or a departing contractor, answer for one item everything that could have learned its value, so the decision to rotate it and the steps to shut each reader out come from one answer.
Required inputs and options#
- One positional item id. --since keeps the journal entries from a UTC time of the vault's stamp form; without it the whole journal is read.
Output and state effects#
- Prints ok, item, since, keys (readers' answer: each key the current ciphertext is encrypted to and whether this keyring holds it), grants (each consumer whose grant reaches the item, with expired and until_revoked), journal_entries (how many entries name it), acted (each consumer the journal names acting on it, with the operations), read_here_by (the AWS profiles and kubeconfig users on this machine that read it through helper answer aws or helper answer kube, each list or the error that kept it from being read) and next (lockdown or grant revoke for the grants, revoke <id> <uid> for keys that should not open it, helper unset aws or helper unset kube for profiles and users here, then replacing the value where it is issued). Nothing is decrypted and no value is printed; an exposure entry is journalled. POST /v1/operator/items/exposure takes id and since; Desktop's item inspector shows it as Who could have learned it.
Refusals#
- No id or more than one exits 2 with the usage, and a --since of another shape with `--since <value> is not a UTC time of the form <now>`. An id the vault does not hold is refused as readers refuses it, and a gpg that cannot list the packets fails with gpg's cause.
Examples#
skarbiec exposure prod-db skarbiec exposure prod-db --since 2026-10-01T00:00:00Z | jq '.acted'