# Weekly 1Password vault audit with Slack digest and Jira tickets > Every Monday morning, spot stale passwords, missing two-factor, and duplicate logins across your vaults, then assign the risky ones for rotation. - Workflow type: agent - Services: 1Password, Slack Bot, Jira - Categories: Operations, Engineering - Published: 2026-08-04 ## What it does - Reviews every vault your team shares and walks its saved items one by one. - Flags four kinds of risk: logins untouched for over a year, accounts with no two-factor or recovery method recorded, passwords that look reused across several services, and vaults that have grown far beyond what their name suggests. - Posts a ranked Slack summary every Monday morning, riskiest first, showing item title, vault name, and last-updated date. - Opens a ticket for each top-tier item so rotation actually gets assigned to someone, and never puts real passwords or secret values into the summary or the ticket. ## What you'll need - A 1Password account with a Connect server your team has already installed, since that is what lets the review read your vaults. - Access granted to each vault you want included. Anything not shared with the connection stays invisible to the review. - A Slack workspace and the channel where the Monday digest should land. - A Jira project, plus the issue type you want rotation tickets filed under. ## Prompt Every Monday at 7am, run a credential hygiene review across our 1Password vaults and give me a prioritized picture of what needs attention. Use the 1Password Connect server credential for this, not the Events API one. The two tokens are not interchangeable, so check the base URL before choosing an operation. Start with List Vaults to enumerate every vault the Connect token can reach. For each vault, call List Items to get its contents. List Items deliberately omits sections and field values, so for any item you intend to evaluate you must call Get Item Details on it individually to read its fields and timestamps. Vault and item collections come back unpaginated as a complete set, so there is no cursor to follow, though you can narrow a collection with a SCIM-style filter if useful (vaults filter on name only, items on title or tag only). Surface four categories of risk. First, items that have not been updated in over a year, judged by the item's last-updated timestamp. Second, login items with no MFA, one-time password, or recovery detail recorded anywhere in their fields. Third, entries that look duplicated or reused, meaning the same credential appears to be saved across several services or vaults, matched on title, username, and website. Fourth, vaults that have quietly grown far beyond what their name implies, for example a narrowly named vault that now holds hundreds of unrelated items. Post the digest with Slack Bot Send a Message to our security channel. Rank the riskiest findings first rather than grouping them by vault, and for each finding give the item title, the vault name, the last-updated date, and one short line on why it was flagged. Put a count per risk category at the top so the trend stays readable week to week. For every item in the top tier, open a Jira Create Issue ticket so rotation actually gets assigned to someone. Title it with the item and vault, describe why it was flagged and what needs to happen, and reference the digest. One ticket per top-tier item, not one ticket for the whole batch. If an item was already ticketed in an earlier run and nothing about it has changed, mention it in the digest but do not open a duplicate ticket. This part is critical. Get Item Details returns real secret values, and none of them may leave 1Password. Never put a password, key, token, one-time password seed, or any other secret value into the Slack message or the Jira ticket. Only item titles, vault names, dates, and your own reasoning belong in the output. If you are unsure whether a piece of data is sensitive, leave it out. ## How to customize - Change the timing. Monday at 7am suits most teams, but a monthly review on the first of the month works just as well for smaller vaults. - Move the staleness line. One year is a common bar, though regulated teams often drop it to 90 or 180 days. - Decide what counts as top tier. Widen or narrow which findings earn a ticket so the rotation queue stays realistic for your team. ## FAQ ### Will my actual passwords show up in Slack or Jira? No. The review opens each item to check its dates and settings, but only item titles, vault names, and dates ever reach the digest or the ticket. Secret values are never copied into either one. ### Do I need a Connect server, or will a regular 1Password login work? You need Connect. It is the piece your team installs that lets software read vaults on your behalf. A personal login will not work for this, and neither will the reporting connection used for sign-in activity. ### How does it decide a password is reused? It compares entries across vaults by title, username, and website to spot the same credential saved in several places. It flags those for a person to confirm rather than deciding on its own. ### What if a vault holds hundreds of items? It still works through them, though large vaults take longer because every item is checked individually. That is one reason most teams schedule it early Monday rather than mid-workday. ### Can it rotate the credentials it flags? No, and that is deliberate. It reports and assigns, so rotating a credential stays a human decision and nothing breaks unannounced. Use this prompt in General Input: https://www.generalinput.com/prompts/weekly-1password-vault-audit-with-slack-digest-and-jira-tickets