Credential And Data Protection

Core Principle

Judge sensitivity by what a file could contain, not by where it lives. If a file type can hold auth data, treat it as sensitive unless clearly proven otherwise.

Generalization Principle

When a security lesson is learned for one kind of sensitive data, generalize the fix across the whole category rather than protecting only the exact instance that triggered the lesson.

Categories include:

• Credentials
• PII
• Customer data
• Infrastructure secrets
• Sensitive logs and error output

Safe Exceptions