Plugin Security Standards

Plugin security standards require that sensitive data must not be hardcoded, must be obtained through secure input, encrypted storage, and timely cleanup, and all input parameters must be strictly validated.

Handling of Sensitive Data

Identification of Sensitive Data

The following types of data are considered sensitive:

• Identity authentication information (token, password, api-key, etc.)
• Personal identity information (name, email, phone number, etc.)
• Project secret information (business plans, source code, etc.)
• System configuration information (database connection strings, etc.)

Handling Principles

1. No Hardcoding: It is strictly prohibited to hardcode sensitive information in the code
2. Use Secure Input: Obtain sensitive data through secure input mechanisms
3. Encrypted Storage: Sensitive data must be encrypted during storage and transmission
4. Minimize Exposure: Expose sensitive data only when necessary
5. Timely Cleanup: Clean up sensitive data in memory after use

Code Examples

// Incorrect: Hardcoded token
const token = 'hardcoded-token-12345';

// Correct: Obtain token through secure input
const token = core.getInput('token');

// Clean up after use
function cleanupSensitiveData() {
  if (token) {
    token = null;
  }
}

Secure Validation of Input Parameters

All input parameters must be strictly validated:

Parameter Type	Validation Rules	Example
String	Length limit, format check	Email format, URL format
Number	Range check, type check	Positive numbers, negative number range limits
File	Path safety check	Prevent path traversal attacks
List	Element validation, length limit	Maximum number of elements limit