Key Status

Key Status tracks suspected and confirmed exposure of keys managed by Drupal's Key module. Record assessments, review decisions, and remediation history without retrieving secret values.

Features

• Mark keys as Unreviewed, Flagged (dirty), Confirmed exposed, or Resolved.
• Display exposure status on the standard Keys administration listing.
• Record status changes with reasons, users, timestamps, and history.
• Control viewing, flagging, and resolution through separate permissions.
• Keep environment-specific assessments outside exported configuration.
• Work with all Key storage providers, with optional Drush commands and Key Audit integration.

Useful for security reviews, incident follow-up, credential rotation, and storage migrations. Changing a key's value or storage provider does not automatically clear an exposure flag.

Post-Installation

Enable Key Status and assign the permissions to view, flag, and resolve exposure assessments. Open Configuration → System → Keys and choose Manage exposure status for a key.

Before recording assessments, set a distinct environment identifier in each deployment's local settings and rebuild caches:

$settings['key_status_environment'] = 'production';

Use different identifiers for development and staging. Never include secret values in assessment reasons. Uninstalling the module removes its assessment and history tables.

Additional Requirements

Requires Drupal 10.3 or later in the 10.x series, or Drupal 11, and Key 1.22 or later in the 1.x series: https://www.drupal.org/project/key.

Optional command-line features require Drush 12.5–12.x or 13.x.

Recommended modules/libraries

Key Audit identifies potentially unsafe secret storage and supports explicitly flagging reviewed findings: https://www.drupal.org/project/key_audit.

Its optional Key Audit Fix submodule records migration attempts and completions in Key Status without automatically resolving exposure assessments.