14-security-secrets

Security & Secrets Handling

PURPOSE: Security and secrets hygiene for rules, examples, and documentation.

🔐 Principles

• Never commit secrets (keys, tokens, passwords, connection strings) to the repository
• Prefer environment variables or secret managers; avoid inline credentials
• Minimize data exposure in logs and outputs; redact sensitive fields consistently
• Use least privilege and time-bounded credentials for investigations
• Use placeholders in all examples and documentation

✅ Do

• Store secrets in environment variables or secure secret stores
• Parameterize credentials and account-specific values in examples
• Provide .example or .template files instead of real secrets
• Validate that examples omit or mask PII/credentials
• Use placeholders: <account_id>, <user_name>, <password>

❌ Don't

• Don't check in .env files with real values
• Don't embed tokens in examples, configs, or documentation
• Don't echo secrets in outputs
• Don't use real account locators or identifiers in examples
• Don't include customer-specific information

🎯 Placeholder Standards

Use These Placeholders

# Good examples with placeholders
<account_locator>    # For account identifiers
<deployment>         # For deployment names (prod3, azeastus2prod)
<account_id>         # For numeric account IDs
<user_name>          # For usernames
<password>           # For passwords
<token>              # For tokens
<request_id>         # For request IDs
<query_id>           # For query IDs
<timestamp>          # For specific timestamps

Example Usage

# ✅ Good - Uses placeholders
snow sql --query "SELECT * FROM snowhouse_import.<deployment>.gs_logs_v WHERE account_id = <account_id>" --format=JSON --connection snowhouse

# ❌ Bad - Real values
snow sql --query "SELECT * FROM snowhouse_import.prod3.gs_logs_v WHERE account_id = 123456" --format=JSON --connection snowhouse

📝 Patterns for Rules

Environment Variable Pattern

# Good - Using environment variables
export SNOW_ACCOUNT="<your_account>"
export SNOW_USER="<your_user>"
export SNOW_PASSWORD="<your_password>"

# Use in commands
snow connection add \
  --name default \
  --account $SNOW_ACCOUNT \
  --user $SNOW_USER \
  --password $SNOW_PASSWORD