Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-06 17:36:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Promote validated community knowledge

Browse source 
Move eight net-new rules into the Microsoft layer, remove six overlapping articles, and update review skill discovery and references.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0b130227-d418-4bc0-9e7d-ec6a37adf039
This commit is contained in:
Jesper Schulz-Wedde 2026-07-14 14:14:07 +02:00
parent be1b92b624
commit c9d90ac605
35 changed files with 136 additions and 478 deletions
Download patch file Download diff file Expand all files Collapse all files

21
community/knowledge/security/secrets-isolated-storage.bad.al
View file

@ -1,21 +0,0 @@
table 50134 "Api Setup Bad Sample"
{
fields
{
field(1; "Primary Key"; Code[10]) { }
// A secret in an ordinary Text field is readable by anyone with table
// permission, ships in RapidStart packages and Excel exports, and
// appears in record snapshots. No DataClassification tag makes it safe;
// it belongs in IsolatedStorage instead.
field(10; "API Key"; Text[250])
{
DataClassification = CustomerContent;
}
}
keys
{
key(PK; "Primary Key") { Clustered = true; }
}
}

15
community/knowledge/security/secrets-isolated-storage.good.al
View file

@ -1,15 +0,0 @@
codeunit 50134 "Api Credential Good Sample"
{
procedure StoreApiKey(ApiKey: SecretText)
begin
// Credentials live in IsolatedStorage, invisible to record reads, API
// pages, RapidStart packages, and Excel export.
IsolatedStorage.Set('ExternalApiKey', ApiKey, DataScope::Module);
end;
procedure GetApiKey() ApiKey: SecretText
begin
if not IsolatedStorage.Get('ExternalApiKey', DataScope::Module, ApiKey) then
Error('The external API key has not been configured.');
end;
}

24
community/knowledge/security/secrets-isolated-storage.md
View file

@ -1,24 +0,0 @@
---
bc-version: [all]
domain: security
keywords: [isolatedstorage, secrets, api-key, oauth-token, connection-string, table-field, credentials]
technologies: [al]
countries: [w1]
application-area: [all]
---
# A secret belongs in IsolatedStorage, never in a table field
> Contributions welcome — open a PR to refine or extend this article.
## Description
API keys, OAuth tokens, client secrets, and connection strings must not be stored in an ordinary table `Text` field — not even on a hidden setup table. A regular field is exposed through record reads, page display, RapidStart and Excel export, report datasets, and surfaces in `DataClassification` review; anyone with table permission can read it. The correct home is `IsolatedStorage`, which is invisible to database queries, API pages, and configuration packages. The storage-*location* decision is the rule here; how to scope and encrypt the value once it is in IsolatedStorage is covered separately.
## Best Practice
Persist every credential with `IsolatedStorage`, write it at the point of capture, and read it only when needed. For the per-secret details — choosing the right `DataScope`, encrypting at rest, and typing the value as `SecretText` so it cannot leak into logs — follow `isolatedstorage-datascope-module-vs-company`, `isolatedstorage-setencrypted-for-sensitive-values`, and `secrettext-for-credentials`.
## Anti Pattern
A "Setup" or "Connection" table carrying a `Text` field named `API Key`, `Password`, or `Client Secret`. The value is now readable by any object with table permission, ships in RapidStart packages and Excel exports, and appears in record snapshots — a credential disclosure that no amount of encryption-in-transit elsewhere makes up for. Reviewer signal: a secret-shaped field declared on a table instead of an `IsolatedStorage` call.