From eaf03f422b9dd65a8486cc3745abab98208069e6 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 16 Aug 2026 21:50:05 +0000
Subject: [PATCH] =?UTF-8?q?=EB=B3=B4=EC=95=88=20=EA=B0=95=ED=99=94:=20?=
 =?UTF-8?q?=ED=99=98=EA=B2=BD=20=EB=B3=80=EC=88=98=EC=97=90=EC=84=9C=20?=
 =?UTF-8?q?=EC=8B=9C=ED=81=AC=EB=A6=BF=20=EB=A1=9C=EB=93=9C=20=EC=A0=9C?=
 =?UTF-8?q?=EA=B1=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

application-buyer-demo.yml 파일에서 `CLEARFOLIO_ARTIFACT_TOKEN_SECRET`과 `CLEARFOLIO_TENANT_CLAIMS_HMAC_SECRET` 환경 변수를 직접 참조하던 설정을 제거했습니다. 이는 리포지토리의 Config & secrets (KV, not env) 보안 규칙을 준수하여, 시크릿이 환경 변수를 통해서가 아닌 설정 트리를 통해서만 로드되도록 강제하기 위함입니다.
---
 .jules/sentinel.md                            | 4 ++++
 src/main/resources/application-buyer-demo.yml | 2 --
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index e795cb9dd..3c5956aee 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -32,3 +32,7 @@
 **Vulnerability:** The document hashing routine in `DefaultDocumentConversionService` processed file streams without enforcing any maximum size limit on the bytes read. An attacker could exploit this by uploading a maliciously large stream (or exploiting a compression bomb if unzipping), exhausting system memory, CPU, or disk space (DoS).
 **Learning:** Checking the declared file size (e.g., `file.getSize()`) in initial validation is not always sufficient if the input stream itself can be spoofed or dynamically expanded during reading. The actual bytes read must be verified against bounds continuously.
 **Prevention:** Always enforce a strict, configurable size limit (e.g., `ConversionProperties.maxUploadSizeBytes`) within the `while` loop that reads from untrusted input streams. Track `totalRead` and throw an exception immediately if the limit is exceeded.
+## 2026-08-16 - Environment Variable Secrets
+**Vulnerability:** Application secrets (like artifact token secrets and HMAC secrets) were loaded directly from environment variables.
+**Learning:** Loading secrets directly from environment variables can lead to exposure if the environment is dumped or logged. It violates the repository's configuration rule requiring secrets to be read from a KV registry or mounted config tree.
+**Prevention:** Remove environment variable fallbacks from configuration files (e.g., `application-buyer-demo.yml`) to enforce the use of secure config trees or KV mechanisms.
diff --git a/src/main/resources/application-buyer-demo.yml b/src/main/resources/application-buyer-demo.yml
index 4e4df4091..56e5437ac 100644
--- a/src/main/resources/application-buyer-demo.yml
+++ b/src/main/resources/application-buyer-demo.yml
@@ -23,9 +23,7 @@ viewer:
 
 clearfolio:
   artifact-token:
-    secret: ${CLEARFOLIO_ARTIFACT_TOKEN_SECRET:}
   tenant-claims:
-    hmac-secret: ${CLEARFOLIO_TENANT_CLAIMS_HMAC_SECRET:}
     max-skew-seconds: ${CLEARFOLIO_TENANT_CLAIMS_MAX_SKEW_SECONDS:300}
   artifact-link-ledger:
     path: ${CLEARFOLIO_ARTIFACT_LINK_LEDGER_PATH:}