From 7e9d01008895b8d840f03098e5af81c93925c78f Mon Sep 17 00:00:00 2001 From: Kenneth Kaye Date: Fri, 17 Jul 2026 15:21:04 -0600 Subject: [PATCH] =?UTF-8?q?docs(reconcile):=20forbid=20echoing=20raw=20com?= =?UTF-8?q?ponent=20response=20bodies=20(=C2=A75)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A component GET/PATCH returns config.settings, which can hold resolved sensitive pass-through values. Require redaction at the source (jq 'del(.config.settings, .config.secrets)') rather than relying on CI secret-masking or the CLI tool sandbox to contain it — closes the gap where a diagnostic curl echoed the input's bucket/role_arn during an apply run. Co-Authored-By: Claude Opus 4.8 --- RECONCILE.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/RECONCILE.md b/RECONCILE.md index 71942a6..cedc7ad 100644 --- a/RECONCILE.md +++ b/RECONCILE.md @@ -91,6 +91,16 @@ repo is public, so both true secrets and sensitive-but-not-secret identifiers empty value. - **Never** print, echo, or log a resolved value — not in the plan, not in apply output, not in the PR comment. Always refer to it as `env:VAR_NAME`. +- **Never emit a raw API response (or request) body for a component to stdout + or logs.** A `GET`/`POST`/`PATCH` on an input or output returns + `config.settings` — which may hold resolved sensitive values (e.g. a bucket or + role ARN). Redact **at the source**: pipe every such call through a filter that + strips those blocks before anything reaches the terminal, e.g. + `curl -s ... | jq 'del(.config.settings, .config.secrets)'`. Do not `curl` a + component endpoint without such a filter, do not `cat`/echo a saved response + body, and do not paste one into your reasoning output. This rule holds even + though CI secret-masking and the CLI tool sandbox usually contain such output + — do not rely on downstream masking. - Secrets are **write-only** in Monad: GET returns them redacted (`{}`), so you cannot diff them; they do **not** participate in hash/drift detection (§7) and you **always** re-send resolved secrets on any create/update. Env-sourced