This was caused by a race condition between the secret being 1st checked for, and the background secret updating thread.

There was a windows where the secret could have been added to the hash table, and not yet filled in when the background secret thread could spot it needed refreshing. The fix is to explicitly return whether the cache entry is new, and use the correct value for the cache update time.

I think the only problem it may have caused in practice is an unnecessary double lookup for secrets in a vault. In real systems the expiry time is 600s rather than 100ms so the windows would have been proportionally much smaller.