GovOPlaN/govoplan-files
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

Harden external file connector boundaries

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 12:10:23 +02:00
parent 3bc1d3489e
commit f2dfb6c90e
18 changed files with 1167 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/CONNECTOR_BOUNDARY.md
View File

@@ -49,8 +49,9 @@ any remote write behavior.
Every provider must:
- enforce GovOPlaN profile visibility and connector policy before browse/import
- keep credentials as environment variables or secret references, never API
response values
- keep credentials as encrypted values or scoped secret references, never API
response values; process-environment references are allowed only in
deployment-owned profiles with an exact deployment allowlist
- import external files into managed storage before they are used in campaigns
or workflows
- preserve source provenance and revision metadata