ITWorx_MCP_Hub-Public/docs/02-security/SECRETS_AND_REDACTION.md

Secrets and Redaction

Storage

Secrets are supplied through Docker secrets or read-only files below /run/secrets. Configuration stores only a secret reference.

Example:

credentials:
  type: docker_secret
  reference: gitea_mcp_read_token

No real secret appears in Git, catalog YAML, .env.example, test fixtures, screenshots, evidence, or generated client configuration.

Redaction stages

1. reject secret-shaped input where a field should not accept it;
2. omit sensitive headers from logs;
3. sanitize target-system output in the connector;
4. apply a final result redaction profile;
5. sanitize audit arguments and response summaries;
6. run automated secret scanning over repository and evidence.

Patterns

At minimum detect:

• bearer/JWT tokens;
• basic auth values;
• private-key blocks;
• common API key formats;
• connection strings with passwords;
• cookies and session IDs;
• Authentik/Gitea tokens;
• environment variable names marked sensitive.

Audit representation

Use a stable argument hash and a small sanitized projection. Never solve auditability by storing the entire raw request.

UI

Secret fields are write-only. The UI shows state such as configured, missing, or last rotated, never the value or a reversible masked form.