452 lines
20 KiB
YAML
452 lines
20 KiB
YAML
# Registry: Secrets Classification
|
|
# SSOT: wiki/projects/ca-tmpl/registries/secrets-classification.yaml
|
|
# Schema owner: feature-contract-registry-governance
|
|
# Owner branch: feature-secrets-config-source-contract
|
|
# Last updated: 2026-05-22
|
|
#
|
|
# Conventions:
|
|
# - 3-tier classification (feature-secrets-config-source-contract 2026-05-22):
|
|
# public-config | sensitive-config | secret
|
|
# - `secret` rows: prod_default 항상 null. dev fake 식별자는 `__LOCAL_DEV_` prefix
|
|
# (feature-secrets-config-source-contract 2026-05-22: "dev/local sentinel value prefix = __LOCAL_DEV_").
|
|
# - prod profile에서 `__LOCAL_DEV_` prefix 발견 시 startup fail
|
|
# (feature-secrets-config-source-contract 2026-05-22).
|
|
# - Masking 기본 = `full_except_last_4` (feature-secrets-config-source-contract 2026-05-22:
|
|
# "full mask except last 4 chars for non-secret tokens"). 진짜 secret(password/private key)은 `full`.
|
|
# - Naming suffix는 보조 신호 (feature-secrets-config-source-contract: "_TOKEN, _KEY, _PASSWORD").
|
|
# - public-config 항목은 env-keys.yaml에서 직접 정의되며 본 파일에는 reference row만 둠.
|
|
|
|
secrets:
|
|
|
|
# === Tier 3: secret (true secret — password/private-key/HMAC-salt) ===
|
|
|
|
- name: APP_DATASOURCE_PASSWORD
|
|
# source: feature-secrets-config-source-contract 2026-05-22
|
|
# "DB credential은 dual-bind 60s" + "__LOCAL_DEV_FAKE_DB_PASSWORD" 예시
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-bind-60s
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:db-password-no-leak-in-actuator
|
|
|
|
- name: APP_SECURITY_JWT_SIGNING_KEY
|
|
# source: feature-secrets-config-source-contract 2026-05-22
|
|
# "JWT signing key는 24h overlap window 유지 (security branch와 cross-link)"
|
|
# + feature-security-operational-baseline "rotation overlap window = 새 kid 도입 → 24h 동안 old kid 병행"
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: overlap-24h
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:jwt-signing-key-rotation-overlap
|
|
|
|
- name: APP_SECURITY_OAUTH_CLIENT_SECRET
|
|
# source: feature-secrets-config-source-contract 2026-05-22
|
|
# "secret classification은 ... naming pattern은 보조(suffix _TOKEN, _KEY, _PASSWORD)"
|
|
# + feature-security-operational-baseline "JWT Resource Server를 baseline security model" (OAuth 자격 증명 분류)
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:oauth-client-secret-no-leak
|
|
|
|
- name: APP_EXTERNAL_API_KEY
|
|
# source: feature-secrets-config-source-contract 2026-05-22
|
|
# "external API key는 application restart 시 reload"
|
|
# (per-dependency suffix는 adapter 등록 시 추가; 본 row는 baseline 분류 정의)
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full_except_last_4
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:external-api-key-no-leak
|
|
|
|
- name: APP_CACHE_REDIS_PASSWORD
|
|
# source: feature-secrets-config-source-contract 2026-05-22
|
|
# 3-tier classification "secret" + feature-integration-adapter-templates "Redis | disabled optional module"
|
|
# (Redis enabled + auth 사용 시 secret으로 분류)
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:redis-password-no-leak
|
|
|
|
- name: APP_CACHE_REDIS_TRUST_PEM
|
|
# Public CA bundle content, but integrity-sensitive and supplied by the mounted environment.
|
|
classification: sensitive-config
|
|
source: mounted-env
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-production-capability
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:redis-trust-reference-no-leak
|
|
|
|
- name: APP_CACHE_REDIS_KEY_HMAC_SECRET
|
|
# Stable cache-key HMAC material. It is distinct from the Redis authentication credential.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: codex-phase-a-ci-recovery
|
|
masking_rule: full
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:redis-key-hmac-no-leak
|
|
|
|
- name: APP_RATE_LIMIT_REDIS_PASSWORD
|
|
# Dedicated coordination-role Redis credential. It is never inherited from cache Redis.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-distributed-rate-limit
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:rate-limit-redis-password-no-leak
|
|
|
|
- name: APP_RATE_LIMIT_REDIS_TRUST_PEM
|
|
# Coordination-role CA bundle content; integrity-sensitive but not credential material.
|
|
classification: sensitive-config
|
|
source: mounted-env
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-production-capability
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:rate-limit-redis-trust-reference-no-leak
|
|
|
|
- name: APP_RATE_LIMIT_REDIS_KEY_HMAC_SECRET
|
|
# Stable private-key derivation material for rate-limit subjects and policy revisions.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-distributed-rate-limit
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:rate-limit-redis-key-hmac-no-leak
|
|
|
|
- name: APP_SESSION_REDIS_PASSWORD
|
|
# Dedicated session-role ACL credential; never shared implicitly with cache or coordination.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-production-capability
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:session-redis-password-no-leak
|
|
|
|
- name: APP_SESSION_REDIS_TRUST_PEM
|
|
# Session-role CA bundle content; integrity-sensitive but not credential material.
|
|
classification: sensitive-config
|
|
source: mounted-env
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-production-capability
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:session-redis-trust-reference-no-leak
|
|
|
|
- name: APP_SESSION_REDIS_KEY_HMAC_SECRET
|
|
# Stable private derivation material for pseudonymous Redis session keys.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-production-capability
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:session-redis-key-hmac-no-leak
|
|
|
|
- name: APP_IDEMPOTENCY_REDIS_KEY_HMAC_SECRET
|
|
# Owner-safe request-replay keys must not expose tenant/scope/request identifiers.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: cold-cutover-restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-production-capability-completion
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:idempotency-redis-key-hmac-no-leak
|
|
|
|
- name: APP_LEASE_REDIS_KEY_HMAC_SECRET
|
|
# Efficiency-lease resource and owner scopes use a dedicated derivation key.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: cold-cutover-restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: redis-production-capability-completion
|
|
masking_rule: full
|
|
compatibility_impact: additive
|
|
required_test: secrets-contract:lease-redis-key-hmac-no-leak
|
|
|
|
- name: APP_PRIVACY_PSEUDONYMIZATION_SALT
|
|
# source: feature-data-retention-privacy-contract 2026-05-22
|
|
# "pseudonymization key = HMAC-SHA-256 with rotating salt. salt rotation interval = 90일.
|
|
# rotation 시 old salt 90일 retain (lookup 가능)."
|
|
# + feature-tenant-context-policy "tenant identifier는 raw PII가 아니어야 하며 ... pseudonymized id"
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: salt-rotation-90d
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-data-retention-privacy-contract
|
|
masking_rule: full
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:pseudonymization-salt-rotation
|
|
|
|
# === Tier 2: sensitive-config (token-bearing URL or id with exposure restriction) ===
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_CONTACT_ENCRYPTION_KEY
|
|
# Encrypts recipient contact points at rest — addresses and phone numbers.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-contact-encryption-no-leak
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_CONTACT_LOOKUP_HMAC_KEY
|
|
# Blind index over contact points, so a lookup never needs the plaintext.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-contact-lookup-hmac-no-leak
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_CALLBACK_SIGNING_KEY
|
|
# Signs the callback URLs a provider posts delivery outcomes back to.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-callback-signing-no-leak
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_PROVIDER_CREDENTIAL_KEY
|
|
# Encrypts stored provider credentials, which are themselves secrets.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-provider-credential-no-leak
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_PAYLOAD_ENCRYPTION_KEY
|
|
# Encrypts notification variables and retained callback bodies at rest.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-payload-encryption-no-leak
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_VAPID_SIGNING_KEY
|
|
# Signs Web Push requests; the browser push service rejects anything else.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-vapid-signing-no-leak
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_PROVIDER_REQUEST_LOOKUP_HMAC_KEY
|
|
# Keyed hash of provider request ids, which are provider-side identifiers.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-provider-request-lookup-hmac-no-leak
|
|
|
|
- name: APP_NOTIFICATION_PLATFORM_CALLBACK_FINGERPRINT_HMAC_KEY
|
|
# Keyed fingerprint of callback bodies, used to detect replays.
|
|
# One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
|
|
# means a compromise of any one of them is a compromise of all eight, and the platform enforces
|
|
# the distinction at startup rather than trusting the deployment to have noticed.
|
|
classification: secret
|
|
source: secret-manager
|
|
rotation_policy: dual-read-restart-only
|
|
prod_default: null
|
|
required_when: ca-skeleton.notification.platform.enabled=true
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: worktree-notification-platform
|
|
masking_rule: full
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:notification-callback-fingerprint-hmac-no-leak
|
|
|
|
- name: APP_NOTIFICATION_SLACK_WEBHOOK_URL
|
|
# source: feature-integration-adapter-templates 2026-05-22
|
|
# "Slack | disabled optional module | notification failure policy"
|
|
# Slack webhook URL은 token을 path에 포함하므로 sensitive-config (URL 형태이지만 secret과 동급 취급)
|
|
classification: sensitive-config
|
|
source: secret-manager
|
|
rotation_policy: manual
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full_except_last_4
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:slack-webhook-no-leak
|
|
|
|
- name: APP_SECURITY_GOOGLE_OAUTH_CLIENT_ID
|
|
# source: feature-secrets-config-source-contract 2026-05-22
|
|
# "sensitive-config" tier (id이지만 노출 제한)
|
|
# + feature-integration-adapter-templates "Google Email | disabled optional module"
|
|
classification: sensitive-config
|
|
source: mounted-env
|
|
rotation_policy: manual
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full_except_last_4
|
|
compatibility_impact: behavior-change
|
|
required_test: secrets-contract:google-oauth-client-id-masked
|
|
|
|
- name: APP_DATASOURCE_USERNAME
|
|
# source: feature-secrets-config-source-contract 2026-05-22 — "sensitive-config" tier
|
|
# (DB user는 password와 함께 노출되면 위험하므로 sensitive-config)
|
|
classification: sensitive-config
|
|
source: mounted-env
|
|
rotation_policy: dual-bind-60s
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full_except_last_4
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:datasource-username-masked-in-actuator
|
|
|
|
- name: APP_DATASOURCE_URL
|
|
# source: feature-secrets-config-source-contract 2026-05-22 — JDBC URL은 host/db 포함하므로 sensitive-config
|
|
# (env-keys.yaml에서는 public-config 처리; 본 파일에서는 노출 통제 관점에서 sensitive로 재분류 — masking 기준 명시 목적)
|
|
classification: sensitive-config
|
|
source: mounted-env
|
|
rotation_policy: restart-only
|
|
prod_default: null
|
|
dev_sentinel_prefix: __LOCAL_DEV_
|
|
owner_branch: feature-secrets-config-source-contract
|
|
masking_rule: full_except_last_4
|
|
compatibility_impact: breaking
|
|
required_test: secrets-contract:datasource-url-masked-in-actuator
|
|
|
|
# === Tier 1: public-config (reference only — full row in env-keys.yaml) ===
|
|
|
|
- name: APP_PROFILE
|
|
# source: feature-env-driven-runtime-configuration — public-config tier reference
|
|
classification: public-config
|
|
source: application-yml
|
|
owner_branch: feature-env-driven-runtime-configuration
|
|
masking_rule: none
|
|
reference: env-keys.yaml#APP_PROFILE
|
|
|
|
- name: APP_NAME
|
|
# source: feature-env-driven-runtime-configuration — public-config tier reference
|
|
classification: public-config
|
|
source: application-yml
|
|
owner_branch: feature-env-driven-runtime-configuration
|
|
masking_rule: none
|
|
reference: env-keys.yaml#APP_NAME
|
|
|
|
- name: SERVER_PORT
|
|
# source: feature-env-driven-runtime-configuration — Spring native, public-config tier reference
|
|
classification: public-config
|
|
source: application-yml
|
|
owner_branch: feature-env-driven-runtime-configuration
|
|
masking_rule: none
|
|
reference: env-keys.yaml#SERVER_PORT
|
|
|
|
- name: SPRING_PROFILES_ACTIVE
|
|
# source: feature-env-driven-runtime-configuration — Spring native, public-config tier reference
|
|
classification: public-config
|
|
source: application-yml
|
|
owner_branch: feature-env-driven-runtime-configuration
|
|
masking_rule: none
|
|
reference: env-keys.yaml#SPRING_PROFILES_ACTIVE
|
|
|
|
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
|
# source: feature-distributed-tracing-contract — public-config tier reference
|
|
classification: public-config
|
|
source: application-yml
|
|
owner_branch: feature-distributed-tracing-contract
|
|
masking_rule: none
|
|
reference: env-keys.yaml#OTEL_EXPORTER_OTLP_ENDPOINT
|