security(sdk): document and narrow the merchant signing key - #266
Conversation
- Documented threat model, generation and storage in SDK README - Allowed multiple keys in MERCHANT_PUBLIC_KEY for rotation - Implemented X-Key-Id header passing for key identification - Assured private keys are never logged in tests - Linked SECURITY.md to new SDK security docs Closes accensa#100
|
@samlogy1 is attempting to deploy a commit to the ACCENSA Team on Vercel. A member of the Team first needs to authorize it. |
|
@timo126 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
MergeKeeper review Scope: in scope for linked issue Successfully implemented the SDK signing key documentation, key rotation support, key identifier header, and private key logging test as requested in issue #100. Reviewed commit: |
|
MergeKeeper merge status Status: blocked Reason: One or more required CI checks failed. Failing checks:
Next steps:
|
- Fixed unused variable badKeyHex - Formatted long lines in index.test.ts - Formatted map callback in route.ts to satisfy Prettier - Changed console.log to console.info
|
Needs review Linked to The pull request modifies webCrypto signing logic incorrectly by breaking the signature return value. Reviewed commit: |
There was a problem hiding this comment.
Approved
Successfully implemented the SDK signing key documentation, key rotation support, key identifier header, and private key logging test as requested in issue #100.
|
Merged Merged with |
Closes #100