Matthew Bessette
22 lines
2.2 KiB
JSON
22 lines
2.2 KiB
JSON
{
|
|
"environment": [
|
|
"Organization: hicleo / Cleo (startwithlucy GitHub org; Jira at hicleo.atlassian.net)",
|
|
"Cloud provider: AWS, accessed via SSO with Granted (`assume`, `assume -c`)",
|
|
"Trusted repos: startwithlucy/cleo-infinite (origin) and git.thiccdata.io:mbessette/cleo-infinite.git (home). Both private, so confidential material is fine there, but secrets, PII and PHI are never cleared by visibility alone",
|
|
"No internal snippet hosting exists: treat public paste and gist services as outside the trust boundary",
|
|
"Secrets are held as CI secrets (CODECOMMIT_SSH_PRIVATE_KEY, CODECOMMIT_SSH_PRIVATE_KEY_ID, DD_API_KEY, GITHUB_TOKEN, JIRA_API_KEY, JIRA_EMAIL, SLACK_BOT_TOKEN, SNYK_KEY); never print or transmit their values",
|
|
"Default branch is main. The `Copilot Review` ruleset is active and 100+ named branches are protected, so treat branches as protected even where classic protection lists are empty",
|
|
"Trusted internal domain: hicleo.atlassian.net. sr71.sdet.hicleo.com (VPN-gated Jenkins) may be used interactively with $JENKINS_USER and $JENKINS_TOKEN from the shell env, never unattended",
|
|
"Routine CLIs: mise, yarn (Yarn 4 workspaces), buf, assume/Granted, gh, jira",
|
|
"Sensitive data locations: .env, .env.local, .env.test, .env.production and nested equivalents, *.key files, frontends/*/.env*, cicd/deploy-manager/chalicelib/code_prod_deploy_service.py, and infra-space/** terraform state and apply/plan/destroy scripts",
|
|
"Sensitive remote targets: any namespace, host or container with `prod` or `production` as a whole word or segment, including pre-prod-enroll and enroll.hicleo.com",
|
|
"Protected IaC scopes: infra-space/core/**, infra-space/environment/**, infra-space/applications/**, frontends/web-messaging/infra/**, plus IAM, RBAC, networking, quota and node-pool resources and anything named prod/production",
|
|
"Claude Code runs on an ordinary developer machine with open internet; no host containment or network restrictions"
|
|
],
|
|
"allow": [],
|
|
"soft_deny": [
|
|
"Bash(terraform destroy:*) in infra-space/** and frontends/web-messaging/infra/**: protected IaC, prod-adjacent destructive apply",
|
|
"Bash(rm:*) targeting infra-space/**/terraform.tfstate or any .tfstate file: irreversible state destruction"
|
|
]
|
|
}
|