Merge remote-tracking branch 'origin/main' into pr49-review-fixes

community/knowledge/security/secrets-isolated-storage.bad.al

@@ -0,0 +1,21 @@
+table 50134 "Api Setup Bad Sample"
+{
+    fields
+    {
+        field(1; "Primary Key"; Code[10]) { }
+
+        // A secret in an ordinary Text field is readable by anyone with table
+        // permission, ships in RapidStart packages and Excel exports, and
+        // appears in record snapshots. No DataClassification tag makes it safe;
+        // it belongs in IsolatedStorage instead.
+        field(10; "API Key"; Text[250])
+        {
+            DataClassification = CustomerContent;
+        }
+    }
+
+    keys
+    {
+        key(PK; "Primary Key") { Clustered = true; }
+    }
+}

community/knowledge/security/secrets-isolated-storage.good.al

@@ -0,0 +1,15 @@
+codeunit 50134 "Api Credential Good Sample"
+{
+    procedure StoreApiKey(ApiKey: SecretText)
+    begin
+        // Credentials live in IsolatedStorage, invisible to record reads, API
+        // pages, RapidStart packages, and Excel export.
+        IsolatedStorage.Set('ExternalApiKey', ApiKey, DataScope::Module);
+    end;
+
+    procedure GetApiKey() ApiKey: SecretText
+    begin
+        if not IsolatedStorage.Get('ExternalApiKey', DataScope::Module, ApiKey) then
+            Error('The external API key has not been configured.');
+    end;
+}

community/knowledge/security/secrets-isolated-storage.md

@@ -0,0 +1,24 @@
+---
+bc-version: [all]
+domain: security
+keywords: [isolatedstorage, secrets, api-key, oauth-token, connection-string, table-field, credentials]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+# A secret belongs in IsolatedStorage, never in a table field
+
+> Contributions welcome — open a PR to refine or extend this article.
+
+## Description
+
+API keys, OAuth tokens, client secrets, and connection strings must not be stored in an ordinary table `Text` field — not even on a hidden setup table. A regular field is exposed through record reads, page display, RapidStart and Excel export, report datasets, and surfaces in `DataClassification` review; anyone with table permission can read it. The correct home is `IsolatedStorage`, which is invisible to database queries, API pages, and configuration packages. The storage-*location* decision is the rule here; how to scope and encrypt the value once it is in IsolatedStorage is covered separately.
+
+## Best Practice
+
+Persist every credential with `IsolatedStorage`, write it at the point of capture, and read it only when needed. For the per-secret details — choosing the right `DataScope`, encrypting at rest, and typing the value as `SecretText` so it cannot leak into logs — follow `isolatedstorage-datascope-module-vs-company`, `isolatedstorage-setencrypted-for-sensitive-values`, and `secrettext-for-credentials`.
+
+## Anti Pattern
+
+A "Setup" or "Connection" table carrying a `Text` field named `API Key`, `Password`, or `Client Secret`. The value is now readable by any object with table permission, ships in RapidStart packages and Excel exports, and appears in record snapshots — a credential disclosure that no amount of encryption-in-transit elsewhere makes up for. Reviewer signal: a secret-shaped field declared on a table instead of an `IsolatedStorage` call.