Security

Security

🇪🇸 Español

Reporting a vulnerability

Please report vulnerabilities privately through GitHub security advisories, not through public issues.

Security model

Credentials

• Cloud and database credentials stay on the server. The browser only talks to the backend APIs.
• In Azure, every component uses managed identities; no secrets are stored in the code.
• Local secrets live in .env, iac/.env, iac/.azure/*.local.json and functions/local.settings.json, all ignored by Git.

Least privilege

Identity	Permissions
Collector Function	Reader on the inventoried subscriptions; write access to its own Storage containers.
Web	Blob read, PostgreSQL DML, Inventory.Generate on the Function API, Cost Management Reader, metrics read and limited Function management for Administration.
Web (Members, optional)	Microsoft Graph User.Read.All application permission only.
Migrator	The only process with DDL on PostgreSQL.

The collector reads resource configuration only. It never reads blob contents, database data, Key Vault secrets, account keys or connection strings.

Authentication and authorisation

• Pages and data APIs are protected server-side. Invalid configuration blocks access instead of falling back to public mode.
• Sessions are HttpOnly, SameSite=Lax JWT cookies that expire after 8 hours.
• Goliat roles are re-checked on the server on every request.
• The Function validates the token signature, issuer, tenant, audience, expiry, client, token type, scope and role before reading the request body.

HTTP hardening

• Data APIs return Cache-Control: private, no-store.
• Responses include X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN and a restrictive referrer policy.
• State-changing requests require a same-origin request and a size-limited JSON body.
• The architecture diagram iframe is sandboxed.

FinOps

Before sending a token to Azure Resource Manager, FinOps validates the origin, URL credentials, subscription path and pagination cycles. It enforces per-process limits and returns 429 with Retry-After when they are exceeded. Subscriptions are fixed on the server; the browser cannot send IDs or endpoints.

Logging

Bodies, cookies, tokens, query strings and SQL are never logged. External errors keep only their type and code.

Resolved advisory

The web and collector now use @azure/identity 4.14.1 with patched @azure/msal-node 7.1.2, resolving GHSA-xcx6-jx8p-x3h5. Both dependency lockfiles have been updated. Keep both projects updated; a clean audit is not a guarantee that no vulnerabilities exist.

Before going to production

• Validate the tenant, permissions, PostgreSQL TLS and the Azure identity of the environment.
• Define a retention policy for snapshots and blobs.
• Apply your organisation's Conditional Access, MFA and guest policies. Goliat roles do not replace them.