--- name: fnox-security-best-practices-f33e16a6b298 user-invocable: false description: Use when implementing secure secrets management with Fnox. Covers encryption, key management, access control, and security hardening. allowed-tools: - Read - Write - Edit - Bash - Grep - Glob --- # Fnox - Security Best Practices Security guidelines and best practices for managing secrets with Fnox. ## Encryption Fundamentals ### Always Encrypt Sensitive Data ```toml # Bad: Plain text secrets committed to git [secrets] DATABASE_PASSWORD = "super-secret-password" API_KEY = "sk-live-12345" # Good: Encrypted secrets [providers.age] type = "age" public_keys = ["age1ql3z..."] [secrets] DATABASE_PASSWORD = { provider = "age", value = "age[...]" } API_KEY = { provider = "age", value = "age[...]" } ``` ### Use Strong Encryption ```bash # Good: age encryption (modern, secure) age-keygen -o ~/.config/fnox/keys/identity.txt # Good: Cloud KMS (managed encryption) [providers.kms] type = "aws-kms" key_id = "arn:aws:kms:us-east-1:..." ``` ## Key Management ### Protect Private Keys ```bash # Store age private key securely chmod 600 ~/.config/fnox/keys/identity.txt # Never commit private keys echo "*.txt" >> ~/.config/fnox/keys/.gitignore ``` ### Separate Public and Private Keys ```toml # fnox.toml (committed) - public keys only [providers.age] type = "age" public_keys = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"] # fnox.local.toml (gitignored) - private keys [providers.age] identity = "~/.config/fnox/keys/identity.txt" ``` ### Rotate Keys Regularly ```bash # Generate new age key age-keygen -o ~/.config/fnox/keys/identity-2025.txt # Re-encrypt all secrets with new key fnox get --all | fnox set --provider age-new ``` ## Access Control ### Use Least Privilege ```toml # Good: Separate secrets by environment [profiles.production] [profiles.production.providers.prod-secrets] type = "aws-sm" region = "us-east-1" [profiles.production.secrets] DATABASE_URL = { provider = "prod-secrets", value = "prod/db" } [profiles.development] [profiles.development.secrets] DATABASE_URL = "postgresql://localhost/dev" # Non-sensitive ``` ### Team Access Control ```toml # Multiple age recipients for team [providers.age] type = "age" public_keys = [ "age1ql3z...", # Alice (admin) "age1qw4r...", # Bob (developer) # Don't include contractors or temporary team members ] ``` ### Role-Based Secrets ```toml # Backend secrets [providers.backend] type = "aws-sm" region = "us-east-1" # Frontend secrets (different access level) [providers.frontend] type = "aws-sm" region = "us-east-1" [secrets] BACKEND_DB_PASSWORD = { provider = "backend", value = "backend/db-pass" } FRONTEND_API_ENDPOINT = { provider = "frontend", value = "frontend/api-url" } ``` ## Git Security ### Never Commit Sensitive Data ```gitignore # .gitignore fnox.local.toml *.age-identity.txt *.key *.pem .env ``` ### Audit Git History ```bash # Check for accidentally committed secrets git log -p | grep -i "password\|secret\|key" # Remove secrets from git history (if found) git filter-branch --force --index-filter \ 'git rm --cached --ignore-unmatch fnox.local.toml' \ --prune-empty --tag-name-filter cat -- --all ``` ### Use Pre-Commit Hooks ```bash # .git/hooks/pre-commit #!/bin/bash if git diff --cached --name-only | grep -q "fnox.local.toml"; then echo "Error: Attempting to commit fnox.local.toml" exit 1 fi # Check for plain text secrets if git diff --cached | grep -q "password.*=.*\"[^a]"; then echo "Warning: Possible plain text password detected" exit 1 fi ``` ## Environment Separation ### Separate Development and Production ```toml # fnox.toml (development) [secrets] DATABASE_URL = "postgresql://localhost/dev" DEBUG = "true" # fnox.production.toml (production secrets) [providers.prod] type = "aws-sm" region = "us-east-1" [secrets] DATABASE_URL = { provider = "prod", value = "prod/db-url" } DEBUG = "false" ``` ### Use Profiles for Environments ```bash # Development fnox exec -- node app.js # Staging FNOX_PROFILE=staging fnox exec -- node app.js # Production FNOX_PROFILE=production fnox exec -- node app.js ``` ## Cloud Provider Security ### AWS Best Practices ```toml # Use IAM roles instead of access keys [providers.aws-sm] type = "aws-sm" region = "us-east-1" # No access_key_id or secret_access_key # Uses IAM role or AWS credentials chain # Restrict by resource tags [providers.aws-sm] type = "aws-sm" region = "us-east-1" # Ensure IAM policy limits access to specific secrets ``` ### Azure Best Practices ```toml # Use managed identity [providers.azure] type = "azure-kv" vault_url = "https://my-vault.vault.azure.net" # Authentication via Azure managed identity ``` ### GCP Best Practices ```toml # Use service account with minimal permissions [providers.gcp] type = "gcp-sm" project_id = "my-project" # Service account with only secretmanager.versions.access ``` ## Audit and Monitoring ### Log Secret Access ```bash # Enable audit logging in cloud providers # AWS CloudTrail for Secrets Manager # Azure Monitor for Key Vault # GCP Cloud Audit Logs for Secret Manager ``` ### Monitor for Anomalies ```bash # Check which secrets are accessed fnox list # Verify provider configuration fnox doctor # Test provider connectivity fnox provider test aws-sm ``` ### Regular Security Audits ```bash # List all secrets fnox list # Verify encryption status fnox doctor # Check for plain text secrets grep -r "password.*=.*\"[^a]" fnox.toml ``` ## Secrets Lifecycle ### Rotate Secrets Regularly ```bash # Generate new secret NEW_PASSWORD=$(openssl rand -base64 32) # Update in fnox echo "$NEW_PASSWORD" | fnox set DATABASE_PASSWORD # Update in actual service (database, API, etc.) # Then verify application still works ``` ### Remove Obsolete Secrets ```bash # Remove unused secret fnox unset OLD_API_KEY # Clean up from cloud provider aws secretsmanager delete-secret --secret-id old/api-key ``` ### Document Secret Purpose ```toml [secrets] STRIPE_API_KEY = { provider = "age", value = "age[...]", description = "Stripe secret key for payment processing. Rotate quarterly." } DATABASE_PASSWORD = { provider = "aws-sm", value = "prod/db-password", description = "PostgreSQL master password. Last rotated: 2025-01-01" } ``` ## CI/CD Security ### Use Dedicated CI Keys ```toml # Separate age key for CI/CD [providers.age] type = "age" public_keys = [ "age1ql3z...", # Developer key "age1ci3d...", # CI/CD key (limited access) ] ``` ### Restrict CI Secret Access ```yaml # .github/workflows/deploy.yml env: FNOX_PROFILE: production # Use GitHub secrets for age identity AGE_IDENTITY: ${{ secrets.AGE_IDENTITY }} steps: - name: Load secrets run: | echo "$AGE_IDENTITY" > /tmp/identity.txt chmod 600 /tmp/identity.txt fnox exec -- ./deploy.sh rm /tmp/identity.txt ``` ### Minimal CI Permissions ```toml # CI profile with minimal secrets [profiles.ci] [profiles.ci.secrets] DEPLOY_TOKEN = { provider = "age", value = "age[...]" } # Don't include database passwords or API keys ``` ## Best Practices Summary ### DO ✅ Always encrypt sensitive secrets ✅ Use strong encryption (age, KMS) ✅ Store private keys securely ✅ Separate dev and prod secrets ✅ Use .gitignore for local overrides ✅ Rotate keys and secrets regularly ✅ Use cloud provider managed identities ✅ Audit secret access ✅ Document secret purpose ✅ Use profiles for environments ### DON'T ❌ Never commit private keys ❌ Never use plain text for sensitive data ❌ Don't share private keys between team members ❌ Don't hardcode credentials ❌ Don't mix dev and prod secrets ❌ Don't skip encryption in production ❌ Don't ignore security warnings ❌ Don't use weak passwords as secrets ## Common Threats and Mitigations ### Threat: Accidental Commit ```bash # Mitigation: Pre-commit hooks cat > .git/hooks/pre-commit <<'EOF' #!/bin/bash if git diff --cached fnox.local.toml > /dev/null; then echo "Error: fnox.local.toml should not be committed" exit 1 fi EOF chmod +x .git/hooks/pre-commit ``` ### Threat: Key Compromise ```bash # Mitigation: Immediate rotation # 1. Generate new key age-keygen -o ~/.config/fnox/keys/identity-new.txt # 2. Re-encrypt all secrets fnox get --all | fnox set --provider age-new # 3. Update public keys # 4. Revoke old key ``` ### Threat: Unauthorized Access ```toml # Mitigation: Use cloud provider IAM [providers.aws-sm] type = "aws-sm" region = "us-east-1" # Restrict with IAM policies: # - Limit to specific secret ARNs # - Require MFA # - Restrict by IP range ``` ## Related Skills - **configuration**: Managing fnox.toml securely - **providers**: Choosing secure providers --- Source attribution: TheBushidoCollective Original project: https://github.com/TheBushidoCollective/han/blob/19caa51d5fd144ef6b2764f2332f4c856aa5d1af/plugins/specialized/fnox/skills/security-best-practices/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice # Functional Source License, Version 1.1, ALv2 Future License ## Abbreviation FSL-1.1-ALv2 ## Notice Copyright 2025 The Bushido Collective ## Terms and Conditions ### Licensor ("We") The party offering the Software under these Terms and Conditions. ### The Software The "Software" is each version of the software that we make available under these Terms and Conditions, as indicated by our inclusion of these Terms and Conditions with the Software. ### License Grant Subject to your compliance with this License Grant and the Patents, Redistribution and Trademark clauses below, we hereby grant you the right to use, copy, modify, create derivative works, publicly perform, publicly display and redistribute the Software for any Permitted Purpose identified below. ### Permitted Purpose A Permitted Purpose is any purpose other than a Competing Use. A Competing Use means making the Software available to others in a commercial product or service that: 1. substitutes for the Software; 2. substitutes for any other product or service we offer using the Software that exists as of the date we make the Software available; or 3. offers the same or substantially similar functionality as the Software. Permitted Purposes specifically include using the Software: 1. for your internal use and access; 2. for non-commercial education; 3. for non-commercial research; and 4. in connection with professional services that you provide to a licensee using the Software in accordance with these Terms and Conditions. ### Patents To the extent your use for a Permitted Purpose would necessarily infringe our patents, the license grant above includes a license under our patents. If you make a claim against any party that the Software infringes or contributes to the infringement of any patent, then your patent license to the Software ends immediately. ### Redistribution The Terms and Conditions apply to all copies, modifications and derivatives of the Software. If you redistribute any copies, modifications or derivatives of the Software, you must include a copy of or a link to these Terms and Conditions and not remove any copyright notices provided in or with the Software. ### Disclaimer THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT. IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE. ### Trademarks Except for displaying the License Details and identifying us as the origin of the Software, you have no right under these Terms and Conditions to use our trademarks, trade names, service marks or product names. ## Grant of Future License We hereby irrevocably grant you an additional license to use the Software under the Apache License, Version 2.0 that is effective on the second anniversary of the date we make the Software available. On or after that date, you may use the Software under the Apache License, Version 2.0, in which case the following will apply: Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: TheBushidoCollective Original project: https://github.com/TheBushidoCollective/han/blob/19caa51d5fd144ef6b2764f2332f4c856aa5d1af/plugins/specialized/fnox/skills/security-best-practices/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Backend Developer, DevOps / SRE, Security Engineer Specialties: Backend Tools: Fnox Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: fddc506ab012e5e6e739c5166498398c30b337fef043bbd236b7368d4c9be6a8