tech-log-backend/docs/registries/secrets-classification.yaml

# Registry: Secrets Classification
# SSOT: wiki/projects/ca-tmpl/registries/secrets-classification.yaml
# Schema owner: feature-contract-registry-governance
# Owner branch: feature-secrets-config-source-contract
# Last updated: 2026-05-22
#
# Conventions:
# - 3-tier classification (feature-secrets-config-source-contract 2026-05-22):
#     public-config | sensitive-config | secret
# - `secret` rows: prod_default 항상 null. dev fake 식별자는 `__LOCAL_DEV_` prefix
#   (feature-secrets-config-source-contract 2026-05-22: "dev/local sentinel value prefix = __LOCAL_DEV_").
# - prod profile에서 `__LOCAL_DEV_` prefix 발견 시 startup fail
#   (feature-secrets-config-source-contract 2026-05-22).
# - Masking 기본 = `full_except_last_4` (feature-secrets-config-source-contract 2026-05-22:
#   "full mask except last 4 chars for non-secret tokens"). 진짜 secret(password/private key)은 `full`.
# - Naming suffix는 보조 신호 (feature-secrets-config-source-contract: "_TOKEN, _KEY, _PASSWORD").
# - public-config 항목은 env-keys.yaml에서 직접 정의되며 본 파일에는 reference row만 둠.

secrets:

  # === Tier 3: secret (true secret — password/private-key/HMAC-salt) ===

  - name: APP_DATASOURCE_PASSWORD
    # source: feature-secrets-config-source-contract 2026-05-22
    # "DB credential은 dual-bind 60s" + "__LOCAL_DEV_FAKE_DB_PASSWORD" 예시
    classification: secret
    source: secret-manager
    rotation_policy: dual-bind-60s
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full
    compatibility_impact: breaking
    required_test: secrets-contract:db-password-no-leak-in-actuator

  - name: APP_SECURITY_JWT_SIGNING_KEY
    # source: feature-secrets-config-source-contract 2026-05-22
    # "JWT signing key는 24h overlap window 유지 (security branch와 cross-link)"
    # + feature-security-operational-baseline "rotation overlap window = 새 kid 도입 → 24h 동안 old kid 병행"
    classification: secret
    source: secret-manager
    rotation_policy: overlap-24h
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full
    compatibility_impact: breaking
    required_test: secrets-contract:jwt-signing-key-rotation-overlap

  - name: APP_SECURITY_OAUTH_CLIENT_SECRET
    # source: feature-secrets-config-source-contract 2026-05-22
    # "secret classification은 ... naming pattern은 보조(suffix _TOKEN, _KEY, _PASSWORD)"
    # + feature-security-operational-baseline "JWT Resource Server를 baseline security model" (OAuth 자격 증명 분류)
    classification: secret
    source: secret-manager
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full
    compatibility_impact: breaking
    required_test: secrets-contract:oauth-client-secret-no-leak

  - name: APP_EXTERNAL_API_KEY
    # source: feature-secrets-config-source-contract 2026-05-22
    # "external API key는 application restart 시 reload"
    # (per-dependency suffix는 adapter 등록 시 추가; 본 row는 baseline 분류 정의)
    classification: secret
    source: secret-manager
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full_except_last_4
    compatibility_impact: breaking
    required_test: secrets-contract:external-api-key-no-leak

  - name: APP_CACHE_REDIS_PASSWORD
    # source: feature-secrets-config-source-contract 2026-05-22
    # 3-tier classification "secret" + feature-integration-adapter-templates "Redis | disabled optional module"
    # (Redis enabled + auth 사용 시 secret으로 분류)
    classification: secret
    source: secret-manager
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full
    compatibility_impact: breaking
    required_test: secrets-contract:redis-password-no-leak

  - name: APP_CACHE_REDIS_TRUST_PEM
    # Public CA bundle content, but integrity-sensitive and supplied by the mounted environment.
    classification: sensitive-config
    source: mounted-env
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-production-capability
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:redis-trust-reference-no-leak

  - name: APP_CACHE_REDIS_KEY_HMAC_SECRET
    # Stable cache-key HMAC material. It is distinct from the Redis authentication credential.
    classification: secret
    source: secret-manager
    rotation_policy: dual-read-restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: codex-phase-a-ci-recovery
    masking_rule: full
    compatibility_impact: breaking
    required_test: secrets-contract:redis-key-hmac-no-leak

  - name: APP_RATE_LIMIT_REDIS_PASSWORD
    # Dedicated coordination-role Redis credential. It is never inherited from cache Redis.
    classification: secret
    source: secret-manager
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-distributed-rate-limit
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:rate-limit-redis-password-no-leak

  - name: APP_RATE_LIMIT_REDIS_TRUST_PEM
    # Coordination-role CA bundle content; integrity-sensitive but not credential material.
    classification: sensitive-config
    source: mounted-env
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-production-capability
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:rate-limit-redis-trust-reference-no-leak

  - name: APP_RATE_LIMIT_REDIS_KEY_HMAC_SECRET
    # Stable private-key derivation material for rate-limit subjects and policy revisions.
    classification: secret
    source: secret-manager
    rotation_policy: dual-read-restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-distributed-rate-limit
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:rate-limit-redis-key-hmac-no-leak

  - name: APP_SESSION_REDIS_PASSWORD
    # Dedicated session-role ACL credential; never shared implicitly with cache or coordination.
    classification: secret
    source: secret-manager
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-production-capability
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:session-redis-password-no-leak

  - name: APP_SESSION_REDIS_TRUST_PEM
    # Session-role CA bundle content; integrity-sensitive but not credential material.
    classification: sensitive-config
    source: mounted-env
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-production-capability
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:session-redis-trust-reference-no-leak

  - name: APP_SESSION_REDIS_KEY_HMAC_SECRET
    # Stable private derivation material for pseudonymous Redis session keys.
    classification: secret
    source: secret-manager
    rotation_policy: dual-read-restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-production-capability
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:session-redis-key-hmac-no-leak

  - name: APP_IDEMPOTENCY_REDIS_KEY_HMAC_SECRET
    # Owner-safe request-replay keys must not expose tenant/scope/request identifiers.
    classification: secret
    source: secret-manager
    rotation_policy: cold-cutover-restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-production-capability-completion
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:idempotency-redis-key-hmac-no-leak

  - name: APP_LEASE_REDIS_KEY_HMAC_SECRET
    # Efficiency-lease resource and owner scopes use a dedicated derivation key.
    classification: secret
    source: secret-manager
    rotation_policy: cold-cutover-restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: redis-production-capability-completion
    masking_rule: full
    compatibility_impact: additive
    required_test: secrets-contract:lease-redis-key-hmac-no-leak

  - name: APP_PRIVACY_PSEUDONYMIZATION_SALT
    # source: feature-data-retention-privacy-contract 2026-05-22
    # "pseudonymization key = HMAC-SHA-256 with rotating salt. salt rotation interval = 90일.
    #  rotation 시 old salt 90일 retain (lookup 가능)."
    # + feature-tenant-context-policy "tenant identifier는 raw PII가 아니어야 하며 ... pseudonymized id"
    classification: secret
    source: secret-manager
    rotation_policy: salt-rotation-90d
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-data-retention-privacy-contract
    masking_rule: full
    compatibility_impact: breaking
    required_test: secrets-contract:pseudonymization-salt-rotation

  # === Tier 2: sensitive-config (token-bearing URL or id with exposure restriction) ===

  - name: APP_NOTIFICATION_SLACK_WEBHOOK_URL
    # source: feature-integration-adapter-templates 2026-05-22
    # "Slack | disabled optional module | notification failure policy"
    # Slack webhook URL은 token을 path에 포함하므로 sensitive-config (URL 형태이지만 secret과 동급 취급)
    classification: sensitive-config
    source: secret-manager
    rotation_policy: manual
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full_except_last_4
    compatibility_impact: breaking
    required_test: secrets-contract:slack-webhook-no-leak

  - name: APP_SECURITY_GOOGLE_OAUTH_CLIENT_ID
    # source: feature-secrets-config-source-contract 2026-05-22
    # "sensitive-config" tier (id이지만 노출 제한)
    # + feature-integration-adapter-templates "Google Email | disabled optional module"
    classification: sensitive-config
    source: mounted-env
    rotation_policy: manual
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full_except_last_4
    compatibility_impact: behavior-change
    required_test: secrets-contract:google-oauth-client-id-masked

  - name: APP_DATASOURCE_USERNAME
    # source: feature-secrets-config-source-contract 2026-05-22 — "sensitive-config" tier
    # (DB user는 password와 함께 노출되면 위험하므로 sensitive-config)
    classification: sensitive-config
    source: mounted-env
    rotation_policy: dual-bind-60s
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full_except_last_4
    compatibility_impact: breaking
    required_test: secrets-contract:datasource-username-masked-in-actuator

  - name: APP_DATASOURCE_URL
    # source: feature-secrets-config-source-contract 2026-05-22 — JDBC URL은 host/db 포함하므로 sensitive-config
    # (env-keys.yaml에서는 public-config 처리; 본 파일에서는 노출 통제 관점에서 sensitive로 재분류 — masking 기준 명시 목적)
    classification: sensitive-config
    source: mounted-env
    rotation_policy: restart-only
    prod_default: null
    dev_sentinel_prefix: __LOCAL_DEV_
    owner_branch: feature-secrets-config-source-contract
    masking_rule: full_except_last_4
    compatibility_impact: breaking
    required_test: secrets-contract:datasource-url-masked-in-actuator

  # === Tier 1: public-config (reference only — full row in env-keys.yaml) ===

  - name: APP_PROFILE
    # source: feature-env-driven-runtime-configuration — public-config tier reference
    classification: public-config
    source: application-yml
    owner_branch: feature-env-driven-runtime-configuration
    masking_rule: none
    reference: env-keys.yaml#APP_PROFILE

  - name: APP_NAME
    # source: feature-env-driven-runtime-configuration — public-config tier reference
    classification: public-config
    source: application-yml
    owner_branch: feature-env-driven-runtime-configuration
    masking_rule: none
    reference: env-keys.yaml#APP_NAME

  - name: SERVER_PORT
    # source: feature-env-driven-runtime-configuration — Spring native, public-config tier reference
    classification: public-config
    source: application-yml
    owner_branch: feature-env-driven-runtime-configuration
    masking_rule: none
    reference: env-keys.yaml#SERVER_PORT

  - name: SPRING_PROFILES_ACTIVE
    # source: feature-env-driven-runtime-configuration — Spring native, public-config tier reference
    classification: public-config
    source: application-yml
    owner_branch: feature-env-driven-runtime-configuration
    masking_rule: none
    reference: env-keys.yaml#SPRING_PROFILES_ACTIVE

  - name: OTEL_EXPORTER_OTLP_ENDPOINT
    # source: feature-distributed-tracing-contract — public-config tier reference
    classification: public-config
    source: application-yml
    owner_branch: feature-distributed-tracing-contract
    masking_rule: none
    reference: env-keys.yaml#OTEL_EXPORTER_OTLP_ENDPOINT