geointel/docs/18-ultra-prep/SECURITY_AND_SECRET_HANDLING.md

Security and Secret Handling

Secrets

Never commit API keys, tokens, model credentials, STAC credentials, database passwords, or private URLs.

Environment Variables

All secrets must be loaded from .env or deployment environment.

File Upload Safety

• limit accepted extensions;
• validate MIME/type where possible;
• store uploads outside source directories;
• generate server-side filenames;
• never execute uploaded files;
• reject path traversal.

External Connectors

• log endpoint names but not credentials;
• timeout external requests;
• cache responses where appropriate;
• show connector status in UI.

AI/Model Safety

• model files must be treated as artifacts;
• do not auto-download arbitrary executable code;
• keep model registry metadata separate from weights.