feat(vault): canary secret templates + generator - #260
Open
LiorFink00 wants to merge 1 commit into
Open
Conversation
Task 3 of the secret-manager honeytoken feature (#255): realistic-but-fake credential templates for popular SaaS tools, and a generator that mints a fresh fake value from one. The value authenticates to nothing - a read of it in a secrets manager is the signal. - 45 template YAMLs under templates/ (stripe, github, slack, aws, datadog, okta, salesforce, ...): each declares name/slug/category, a value format (prefix/length/charset), suggested vault paths, and metadata. Pure format specs - no real secrets; values are minted at runtime. - services/templates.py: list_templates() / get_template(slug) / generate_value(template), reading templates/ under REPO_ROOT (cached). - Dockerfile: COPY templates/ into the image so the loader finds them at runtime. Ported from the enterprise implementation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018DARDAxeg4NM8FKoyGMQZy
This was referenced Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task 3 of #255 (secret-manager honeytokens) — the canary credential templates.
Changes
templates/(stripe, github, slack, aws, datadog, okta, salesforce, gcp, azure, snowflake, ...). Each declaresname/slug/category, a valueformat(prefix/length/charset),suggested_paths, andmetadata. Pure format specs — no real secrets; actual values are minted at runtime.services/templates.py—list_templates()/get_template(slug)/generate_value(template), loadingtemplates/underREPO_ROOT(cached, sorted by category→name).generate_valuemints a fresh fake credential matching the format (charsets: alphanumeric, dash, special, hex, uppercase).COPY templates/so the loader finds them in the image (it previously only copiedserver/,plugins/,agent/).Scope
Independent of the other vault tasks (#257 framework, #259 models). Consumed later by the vault routes/UI to offer canary formats.
Safety
I scanned all 45 templates — they contain only format descriptors (prefix/length/charset) and example paths, no literal credentials. The only "password" match is the credential-type name "Bitbucket App Password".
Tests
tests/test_templates.py— 10 tests: listing, category sort, required shape on every template, get-by-slug, andgenerate_valueacross prefix/length/alphanumeric/hex/uppercase + uniqueness. ruff clean.Part of #255.