Reviewing Credential Security with Watchtower and Health

StretchVault doesn't just store secrets — it tells you how healthy they are. Watchtower is the security review that scans a vault and turns it into a single score plus a prioritized list of problems. The Health tab confirms the underlying protections are in place.

The Health tab: is everything protected?

Start with Health. It answers two foundational questions:

1. Is encryption configured? It shows whether AES-256-GCM encryption is active. If it isn't, secret-bearing saves are refused, so this is the first thing to confirm.
2. Is the security engine online? Watchtower, Breach-watch, rotation planning, strength analysis, and the generator all depend on the engine. Health shows its status so you know the intelligence features are available.

If either shows a problem, resolve it (or contact your administrator) before relying on the security features below.

What Watchtower checks

Run Watchtower on a vault from the Watchtower tab. It reviews every item and classifies each into one or more risk categories:

• Exposed — the secret matched a common-breach list, or was flagged as exposed. This is the most serious category.
• Reused — the same secret value is used on more than one item. Watchtower detects this using a cryptographic fingerprint (a one-way hash), never by comparing plaintext — your secrets are never sent anywhere to check for reuse.
• Weak — the strength score is below the weak threshold (50 by default).
• Old — the secret hasn't been rotated in a long time (older than 365 days by default).
• No 2FA — the account's two-factor flag is off.

The security score

Watchtower rolls those findings into a security score from 0 to 100 and a label:

• Excellent — 90 or above.
• Good — 70 to 89.
• Fair — 50 to 69.
• At risk — below 50.

The score starts at 100 and deducts weighted by how much of your vault is affected. Exposed credentials carry the heaviest penalty, followed by reuse, then weak, then old, then missing 2FA. Because the penalty scales with the share of affected items, fixing your worst offenders moves the score quickly.

Running a review, step by step

1. Open the Watchtower tab and select the vault to review.
2. Click Run review.
3. Read the security score and label at the top.
4. Work down the findings: each category lists the affected items and a recommendation such as "rotate 2 exposed secret(s) immediately" or "make 3 reused secret(s) unique."
5. Fix the highest-severity items first (exposed, then reused, then weak).
6. Re-run the review to confirm the score improved.

Each full run is saved to your Audit history, so you can show that posture improved over time — useful for compliance and client reporting. If you just want to look without recording a run, StretchVault also offers a read-only preview that computes the same score without saving anything.

A realistic example

Meridian Studio runs Watchtower on their Client Credentials vault and gets a score of 58 (fair). The findings show 2 exposed logins, 3 passwords reused across two clients, and 4 items with no 2FA. They generate fresh passwords for the exposed and reused items, enable 2FA on the four accounts, and re-run. The new score is 91 (excellent), and both runs are saved in Audit — so when the client asks about security, the owner can show the before-and-after.

Watchtower vs. Breach-watch

Both surface risky credentials, but they serve different moments. Watchtower is the thorough, scored, saved review you run periodically. Breach-watch is a quick exposure scan you glance at any time. See Breach-watch and Exposure Monitoring for the fast scan.

Tips

• Run Watchtower on a schedule (for example the first Monday of each month) and after any suspected incident.
• Chase the exposed category first — it's the heaviest penalty and the highest real-world risk.
• Set the 2FA flag accurately on every item; it's the easiest category to clear and directly lifts your score.
• Keep runs in Audit as evidence of continuous improvement for client or compliance reviews.

Troubleshooting

"StretchVault engine is not enabled." Watchtower needs the security engine. Check the Health tab; if the engine is off, contact your workspace administrator.

The score seems low despite few problems. In a small vault, a single exposed or reused item is a large share of the total, so it moves the score a lot. Fix that item and re-run.

A reused item looks unique to me. Reuse is detected by fingerprint across the vault — the identical value likely exists on another item you've forgotten. Change one of them to a freshly generated value.