Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-10-05 14:46:55 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
bcquality/custom/knowledge/security/secrets-isolated-storage.md
Michael Dieringer d4e351f333 Adopt 11 community rules into custom always-on layer 
Promotes rules that are already published in community/ to custom/knowledge/,
so they load at every session start instead of only on keyword relevance.
Each file carries extends: pointing back to its community source.

Passed Immanuel's four-test Categorical Imperative validation on 2026-08-07.
2026-08-07 08:04:12 +02:00

1.8 KiB
Raw Blame History

bc-version domain keywords technologies countries application-area extends
all
security
isolatedstorage
secrets
api-key
oauth-token
connection-string
table-field
credentials
al
w1
all
community/security/secrets-isolated-storage.md

A Secret Belongs In IsolatedStorage, Never In A Table Field

Contributions welcome — open a PR to refine or extend this article.

Description

API keys, OAuth tokens, client secrets, and connection strings must not be stored in an ordinary table Text field — not even on a hidden setup table. A regular field is exposed through record reads, page display, RapidStart and Excel export, report datasets, and surfaces in DataClassification review; anyone with table permission can read it. The correct home is IsolatedStorage, which is invisible to database queries, API pages, and configuration packages. The storage-location decision is the rule here; how to scope and encrypt the value once it is in IsolatedStorage is covered separately.

Best Practice

Persist every credential with IsolatedStorage, write it at the point of capture, and read it only when needed. For the per-secret details — choosing the right DataScope, encrypting at rest, and typing the value as SecretText so it cannot leak into logs — follow the companion rules on IsolatedStorage DataScope, SetEncrypted, and SecretText.

Anti Pattern

A "Setup" or "Connection" table carrying a Text field named API Key, Password, or Client Secret. The value is now readable by any object with table permission, ships in RapidStart packages and Excel exports, and appears in record snapshots — a credential disclosure that no amount of encryption-in-transit elsewhere makes up for. Reviewer signal: a secret-shaped field declared on a table instead of an IsolatedStorage call.