cleveragents-core/.opencode/skills/cleverthis-guidelines/references/security

Security Policy

Password Management

Mandatory rules — no exceptions:

1. Password manager: gopass ONLY (no third-party tools, no built-in browser managers).
2. Protected by: Yubikey hardware security token.
3. NEVER write passwords in plain text (no spreadsheets, notes, physical diaries, digital files).
4. NEVER reuse passwords across different systems or services.
5. NEVER share passwords — even with supervisors, team members, or IT staff.
6. Team-shared secrets: dedicated team-shared gopass repository folder.
7. Passwords: use random characters, sufficiently long and unpredictable.
8. Suspected compromise: change immediately + notify EP (Executive President).
9. Admin/root passwords: change if team membership changes or risk increases.
10. ELB can request compliance audit at any time; non-compliance → disciplinary action.

---

Yubikey Hardware Tokens

• Required for: everyone with access to systems containing sensitive/confidential information.
• Setup: registered and enabled with company's approved authentication/encryption systems.
• Labeling: each Yubikey clearly labeled or serial-numbered to identify owner.
• New/replacement devices: recorded in company-managed registry (gopass).
• Physical possession: mandatory during working hours and remote system access.
• NEVER lend or share your Yubikey (sharing = prohibited).
• Lost/damaged/compromised: immediately notify EP + designated IT representative + security lead for deactivation and replacement.
• Testing: periodically test functionality; malfunctioning device replaced without delay.
• PINs for Yubikey: follow all password management rules, kept secret.

---

Encryption

• All data classified Confidential / Restricted / Secret / Trade Secret:
  • Must be encrypted when stored on portable devices.
  • Must be encrypted when transmitted outside internal networks.
• Encryption algorithms: only EP-approved algorithms permitted.
• Private key sharing: prohibited except under explicit emergency procedures.
• Key rotation: periodic rotation and revocation required.
• Digital signatures on high-level documents: approved tools only meeting legal validity standards.
• Hardware token: all code commits requiring authentication must use recognized digital signature tied to hardware security token.
• Quarterly testing: all hardware security tokens tested for firmware updates and compatibility with approved encryption tools; results logged in security ticket queue.

---

Code Security

• NEVER hardcode credentials, tokens, API keys in code or configuration.
• Use environment variables or secrets management systems.
• Violations = security breach; report immediately.
• Security scanning must run on every PR via the task runner (e.g. nox -s security_scan).
• All PRs must pass the security scan before approval.

---

Reporting Security Incidents

1. Suspected compromise → immediately change credentials + notify EP.
2. Unusual login attempts / hardware token tampering → notify EP + security team.
3. Any breach → report to supervisor or security liaison immediately.
4. Non-compliance with security rules → corrective measures or disciplinary action.