Skip to content

Security rules for collectors

Section 16 · From docs/INVENTORY_INTERNALS.md on GitHub

These rules are enforced in review and by CodeQL; follow them in every collector:

  1. Never collect secret values. Record names, ARNs and metadata, never values: no SSM parameter values, no environment variable values (environment_keys and identifier_refs only), no passwords, pre-shared keys, auth keys, webhook secrets, connection strings, user data. Cloud Control properties go through redact().
  2. Never log secrets or secret names in a way that looks like one. Log identifiers and error codes; do not interpolate values that came from secret-bearing fields.
  3. Strip credentials from URLs. Use _clean_url() / url_alias(); repository URLs can embed tokens, and query strings can carry signatures.
  4. Judge URLs on the parsed host. Use urlsplit() and an anchored, full-match regular expression on the host (as _is_sqs_queue_url and _image_registry_host do), never substring checks on the whole string.
  5. No regular expressions with nested quantifiers on attacker-influenced input (resource names, tags, policy documents). Prefer splitting and parsing.
  6. Read-only calls only. No Create*, Put*, Update*, Delete*, and in Kubernetes only GET.
  7. Do not widen permissions in docs or defaults. Recommend read-only roles.