Instruction file imported from strps/hacienda-cr-fe-sdk (.github/instructions/security.instructions.md). Copyright stays with the author.

Security Guidelines — hacienda-cr-fe-sdk

Credential Handling

• CertConfig.pass (P12 passphrase) must NEVER be:
  • Logged to console, file, or monitoring
  • Included in error messages or stack traces
  • Serialized to JSON, XML, or any output format
  • Passed to external services beyond the signing operation
• Same rules apply to HaciendaClientConfig.password (IdP password)

Token Safety

• Access tokens are short-lived (300s) — never persist to disk
• Clear token from memory on TokenManager disposal
• Never include tokens in error payloads or logs

P12 Certificate Loading

• Use Node.js built-in crypto module to parse PKCS#12
• Never shell out to openssl or external tools
• Validate certificate is not expired before attempting to sign
• Handle wrong-passphrase errors gracefully without leaking the passphrase

Input Validation

• Validate ALL external data at system boundaries with Zod schemas:
  • User-provided config (HaciendaClientConfig)
  • API responses from Hacienda
  • Callback payloads
• Never trust Hacienda API response shapes without validation

HTTP Security

• Always use HTTPS — never allow HTTP fallback
• Set reasonable timeouts on all HTTP calls (30s default)
• Do not follow redirects to different domains