| owner |
security |
| status |
draft |
| last_verified |
2026-03-07 |
| source_of_truth |
../kb-server/app/core/auth.py |
../kb-server/app/core/config.py |
|
| related_code |
../kb-server/app/main.py |
../vault-sync/vault_sync/api_client.py |
|
| related_tests |
|
| review_cycle_days |
21 |
- API key auth is enforced by server middleware when configured (
KB_API_KEY non-empty).
- With auth enabled, all HTTP routes require
X-API-Key, including /health, /ready, /docs, and /openapi.json.
- With auth disabled (
KB_API_KEY empty), requests are accepted without API-key checks.
KB_API_KEY must never be committed in docs examples with live values.
- Secrets remain in local
.env files or deployment secret stores.
- Docs should only reference secret names, not values.
- Generated docs must redact secrets by default.
- Path traversal and absolute-path writes are denied.
- Only approved file types are writable.
- Writes from
source=api remain review-gated through PR workflow.
Update this document when changing:
- auth middleware/dependency behavior
- request validation and path sanitization
- external webhook/publish execution semantics
- GitHub token scope or PR automation behavior