security

Security

OTP delivery vs vault

• Delivery (template / otp): you generate the code; package only sends it.
• Vault (challenge): package generates, stores HMAC, checks attempts/TTL.

Recommendations

1. Enable redact: SMSAPI_OTP_REDACT=true (default on in config).
2. Prefer sync vault sends (allow_queue=false).
3. Set SMSAPI_OTP_PEPPER or rely on a strong APP_KEY.
4. Enable per-recipient rate limits (smsapi:install resilience).
5. Never log $issued->code unless reveal_code is intentionally on in non-prod.
6. Treat queue workers / failed_jobs as sensitive if vault queue is enabled.

Redaction

Sensitive keys (CODE, otp, token, …) are scrubbed from sms_logs.parameters, content, and nested response when redact is enabled.